MCP server · agentprime

What it does

The MCP server gives an AI assistant agentprime’s data and lockfile check as tools it can call while it works with you. Ask about an id you’ve seen in a post, look for what’s critical this week, or check the project open in front of it.

The same data as the site. Every Advisory and CVE we publish, with CVSS severity, CISA KEV, EPSS and our critical flag. Every record links to its page here, https://agentprime.io/advisories/<id>/.
The same check as the site. The same matcher and upgrade plan as Check your lockfile and POST /v1/match. Withdrawn and retracted Advisories never match.
Labelled honestly. Machine-written summaries come labelled “Machine-written summary, not reviewed by a person”. A profile someone at agentprime reviewed comes labelled “Reviewed by …”.
Third-party text is data, not instructions. Titles, summaries, package and product names, references and machine summaries are quoted from advisory sources, and every answer says so. Invisible and bidirectional Unicode characters are removed from them.
A Match isn’t a verdict. A Match means an installed version is in an Advisory’s affected range. Most don’t affect your app; the plugin checks your code.

Tools

Each tool answers with short text for the assistant to read, plus the full result as structured JSON (structuredContent).

search_advisories

{ query?, tag?, technology?, ecosystem?, package?, kind?, critical?, kev?, min_score?, limit?, cursor? }

Searches every published Advisory and CVE with the same filters as the API’s list: words, as in a web search engine, or an id (most relevant first, exact ids first); a weakness tag such as sql-injection or xss; a technology such as fortinet-fortimail; ecosystem, package, package Advisories or CVE records, critical, CISA KEV, minimum CVSS score. Without words, newest first. Up to 50 records a call, each with its severity, critical reasons, KEV and EPSS, affected packages, fixed versions, tags and page link.

Try “Using agentprime, list the critical npm advisories that are in CISA KEV.”

get_advisory

{ id }

One record by any id or alias: GHSA, CVE, PYSEC, GO, RUSTSEC. Returns the full detail: affected ranges and fixed versions (or a CVE’s vendors and products), CVSS severity, critical reasons, KEV and EPSS, CWEs and references. It also returns the machine-written summary, labelled as not reviewed by a person, and any reviewed Advisory profile.

Try “What is CVE-2025-46734? Which versions of league/commonmark does it affect, and what fixes it?”

check_packages

{ packages: [{ ecosystem, name, version }] }

Checks up to 5,000 installed packages against every Advisory and known malicious package. It returns the Matches and an upgrade plan: for each package, the lowest version that clears its Matches. It uses the same matcher and gives the same result as the lockfile check on this site.

Try “Check lodash 4.17.20 and axios 0.21.0 from npm with agentprime. What should I upgrade?”

check_lockfile

{ filename, contents }

Sends a whole lockfile (up to 5 MB). It’s read on our server, then checked the same way as check_packages. You also get back notes from reading the file and any packages we couldn’t check. Reads composer.lock, package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, go.mod, Gemfile.lock, mix.lock, packages.lock.json and gradle.lockfile.

Try “Check this repo’s package-lock.json with agentprime and tell me which upgrades clear the most Matches.”

Watching, with a key

These tools save to your free account, so they need your key. Without one they answer with an error that says how to add it. Lockfiles watched here show up in your account, alongside ones you watch from the website.

watch_lockfileNeeds a key

{ filename, contents, label? }

Reads a lockfile on our server, the same way as check_lockfile, and watches it in your account: we email you when a new Advisory matches it. Only each package’s ecosystem, name and version, and your label, are saved, encrypted; the file itself is dropped. Up to 10 watched lockfiles per account.

Try “Watch this repo’s package-lock.json with agentprime, and call it “Main app”.”

watch_packagesNeeds a key

{ packages: [{ ecosystem, name, version }], label? }

Watches a package list your assistant has already read, so the lockfile never leaves your machine. Counts towards the same 10.

Try “Read this project’s lockfile, then watch its packages with agentprime.”

list_watchedNeeds a key

{}

Lists the lockfiles your account watches: each one’s id, label, package count, Matches and when it was added, whether it was added here, on the website or by another agent with your key.

Try “Which lockfiles is agentprime watching for me?”

unwatchNeeds a key

{ id }

Stops watching a lockfile and deletes its saved list. The id comes from list_watched.

Try “Stop watching the “Old prototype” lockfile in agentprime.”

Set up

Claude Code

Run this once in a terminal. Then ask Claude Code about an Advisory, or to check the lockfile in the repository you’re in.

claude mcp add --transport http agentprime https://api.agentprime.io/mcp

# Available in every project, not only this one
claude mcp add --transport http --scope user agentprime https://api.agentprime.io/mcp

Check it’s connected with /mcp inside Claude Code, or claude mcp list.

Claude Desktop and claude.ai

Open Settings → Connectors, choose Add custom connector, name it agentprime and paste the endpoint, https://api.agentprime.io/mcp. No sign-in is needed. Then turn it on for a chat from the tools menu.

If your version of Claude Desktop has no custom connectors, add it to claude_desktop_config.json through the mcp-remote bridge (needs Node.js), then restart Claude Desktop:

{
  "mcpServers": {
    "agentprime": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.agentprime.io/mcp"]
    }
  }
}

Other clients

Any client that supports remote MCP servers over streamable HTTP can connect. Most take a config like this; some call the top-level key servers, or leave out type.

{
  "mcpServers": {
    "agentprime": {
      "type": "http",
      "url": "https://api.agentprime.io/mcp"
    }
  }
}

The server is stateless: every request is a JSON-RPC POST, answered with plain JSON. There are no sessions and no event stream, so GET answers 405. You can call it directly too:

curl -s https://api.agentprime.io/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"get_advisory","arguments":{"id":"CVE-2025-46734"}}}'

Add your free key for 10x limits and lockfile watching

Everything above works without a key. A free key raises your limits tenfold and lets your assistant watch lockfiles. Sign in and create one: it’s shown once, so copy it then. Send it as Authorization: Bearer YOUR_KEY.

Claude Code:

claude mcp add --transport http agentprime https://api.agentprime.io/mcp --header "Authorization: Bearer YOUR_KEY"

If you added agentprime without a key, remove it first with claude mcp remove agentprime.

Cursor and other clients that support remote servers take a headers object:

{
  "mcpServers": {
    "agentprime": {
      "type": "http",
      "url": "https://api.agentprime.io/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

Claude Desktop, through the mcp-remote bridge (the key goes in env, so the space after Bearer survives):

{
  "mcpServers": {
    "agentprime": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.agentprime.io/mcp", "--header", "Authorization:${AGENTPRIME_AUTH}"],
      "env": { "AGENTPRIME_AUTH": "Bearer YOUR_KEY" }
    }
  }
}

Custom connectors in claude.ai and Claude Desktop’s settings can’t send a header, so they use the limits without a key, and can’t watch.

Keep your key out of repositories. If one leaks, revoke it in your account; it stops working at once.

Privacy

check_lockfile: the lockfile you send is parsed on our server and dropped once the check is done. It’s never stored or logged, and never quoted back in an error: if it can’t be read, the error names only the format and a line number.
check_packages: only each package’s ecosystem, name and version are sent. That list isn’t stored or logged either.
The other two tools read public records. Like any web server, we see the address a request comes from, which is what the rate limit counts.
watch_lockfile and watch_packages: the file is read on our server and dropped, as with check_lockfile. Only { ecosystem, name, version } for each package, and your label, go to your account, where they’re stored encrypted. The MCP server itself never stores them, and never learns your email address: your key identifies your account only to the accounts service.

If you’d rather nothing about your lockfile leaves your machine except names and versions, have your assistant read the file and call check_packages, or use Check your lockfile here, which reads the file in your browser.

Limits

60 requests a minute per address, across all tools. With a key, 600 a minute per key, wherever you call from.
Each call also counts towards the API’s limits per address per minute: the two checks towards 30 checks (shared with /v1/match), search_advisories with a query towards 30 searches, and the rest towards 120 reads.
Over a limit you get HTTP 429 with Retry-After, in seconds, and a JSON-RPC error. When we’re busy you get 503 with Retry-After. Retry after that.
With a key, the API limits are 10x too: 1,200 reads, 300 searches and 300 checks a minute. A key that’s wrong or revoked gets HTTP 401 and a JSON-RPC error; it never falls back to the limits without a key.
Each account can watch 10 lockfiles. The 11th gets an error saying so; stop watching one with unwatch or in your account.
query is at most 100 characters.
At most 5,000 packages per check, 5 MB per lockfile, and 12 MB per request; a bigger request gets 413.
search_advisories returns at most 50 records a call; pass next_cursor back as cursor for more.

Records come from the GitHub Advisory Database (CC-BY 4.0), OSV, the CVE List, NVD, CISA KEV and FIRST EPSS.

agentprime, inside your AI assistant.