DataNexus MCP

What it is

A hosted MCP server over verified public data sources. The centre of gravity is software supply-chain security — CVEs, SBOMs, licences, typosquatting — but it also covers the record sets that due diligence runs on: IRS 990 filings, SAM.gov exclusions, federal contract awards, patents, NPI and FINRA registrations, domain and certificate data. Everything comes back as markdown built for reading, not raw API JSON.

What you get

• 55 tools behind one URL, with a search tool for finding the right one — search_datanexus_tools
• CVE triage that answers in one call rather than three: a verdict combining CVSS severity, whether CISA lists it as known-exploited, and the EPSS exploitation probability — with each of those also available on its own — security_fetch_cve_risk_summary, security_fetch_cve_detail, security_fetch_cisa_kev, security_fetch_cve_epss
• Package and dependency work: vulnerabilities for any npm, PyPI, Go, Maven or Cargo package at a specific version, the transitive dependency tree with vulnerable transitive dependencies flagged, and a single SHIP/CAUTION/BLOCK verdict combining CVEs, licence risk and maintainer health — security_fetch_package_vulnerabilities, security_fetch_dependency_graph, security_fetch_package_risk_brief
• SBOM auditing against a CycloneDX or SPDX document — one-off, registered for continuous re-checking as new CVEs appear, or audited against a custom licence policy returning PASS/WARN/BLOCK per package — security_audit_sbom_vulnerabilities, security_audit_sbom_continuous, security_audit_sbom_license_policy
• Licence intelligence in plain English: what an SPDX identifier permits and obliges, and a compatibility audit naming the specific conflicting pairs with remediation — security_fetch_licence_analysis, security_audit_licence_compatibility
• Supply-chain signals beyond CVEs — maintainer ownership timelines with an anomaly score for sudden transfers, and typosquat detection by edit distance against the package corpus — security_fetch_package_maintainer_history, security_detect_typosquatting
• Frontend-specific tools scoped to npm: a manifest audit of your package.json with an optional lockfile for pinned accuracy, a CI-config scan for exposed secrets and unpinned actions that deliberately never flags proper secret references, and typosquat detection against a curated frontend corpus — frontend_security_audit_manifest, frontend_security_audit_ci_pipeline, frontend_security_detect_typosquatting
• A persistent CVE watchlist with a polling inbox that returns only what changed since your last check — security_fetch_cve_watch, security_fetch_cve_watch_status
• Nonprofit research from IRS and ProPublica data: a full 990-based due-diligence profile with health score and programme ratio, multi-year financial trends, and search by name, state or mission category, plus UK Charity Commission records — nonprofit_fetch_nonprofit_full_profile, nonprofit_fetch_nonprofit_financial_trends, nonprofit_search_nonprofits_by_category, nonprofit_fetch_charity_uk
• Compliance and identity checks: federal exclusion status on SAM.gov, healthcare provider lookup and search in the NPI registry, and FINRA broker registration with disclosures — compliance_check_sam_exclusion, compliance_fetch_npi_provider, compliance_search_npi_by_name, compliance_fetch_finra_broker
• Domain intelligence: DNS records, an A–F graded email-security check across SPF, DMARC and DKIM, registration details over RDAP, co-hosted domains, subdomain enumeration and certificate chains from transparency logs — domain_fetch_dns_records, domain_check_email_security, domain_fetch_domain_rdap, domain_fetch_subdomains, domain_fetch_ssl_certificate_chain
• Patents, federal contracts and regulatory dockets — patent records, keyword search, inventor portfolios and citation chains; vendor award history, award search and open solicitations; open rulemakings, docket detail and Federal Register notices — legal_fetch_patent_by_number, legal_fetch_inventor_portfolio, govcon_fetch_vendor_contract_history, govcon_fetch_open_solicitations, regulatory_search_open_rulemakings

Requirements

Nothing to start: add the hosted HTTP endpoint and you get 100 calls a month anonymously, with no account and no card. Generating a free key from inside the client raises that to 500 a month — the key is issued to an email address, returned once, and passed thereafter in a header; rotation and revocation are tools of their own. There is also an npx path for stdio clients. Every response carries a usage field showing the month's count against your limit. Licence is BSL 1.1.

Setup effort

One command — npx -y @datanexusmcp/mcp-server

Tools you get

55 tools named in the project's documentation.

Requires

A client that can reach a remote MCP server over HTTP

Where it runs

Of the 3 documented clients, 2 run the server on your machine and 1 connects to a hosted endpoint.