The separate sources here are all public and all free to query yourself; the work is in combining them. A CVE's CVSS score alone does not tell you whether to drop everything — the score crossed with the exploited-in-the-wild catalog and the exploitation probability does, and getting that as one verdict is the difference between triage and a research project. The same instinct runs through the frontend tools, which return one recommendation with licence and abandonment signals folded in rather than a CVE dump. Worth knowing before you lean on it: the free tiers are metered per month, and the licence is BSL rather than a standard open-source one.
A hosted MCP server over verified public data sources. The centre of gravity is software supply-chain security — CVEs, SBOMs, licences, typosquatting — but it also covers the record sets that due diligence runs on: IRS 990 filings, SAM.gov exclusions, federal contract awards, patents, NPI and FINRA registrations, domain and certificate data. Everything comes back as markdown built for reading, not raw API JSON.
- 55 tools behind one URL, with a search tool for finding the right one — `search_datanexus_tools`
- CVE triage that answers in one call rather than three: a verdict combining CVSS severity, whether CISA lists it as known-exploited, and the EPSS exploitation probability — with each of those also available on its own — `security_fetch_cve_risk_summary`, `security_fetch_cve_detail`, `security_fetch_cisa_kev`, `security_fetch_cve_epss`
- Package and dependency work: vulnerabilities for any npm, PyPI, Go, Maven or Cargo package at a specific version, the transitive dependency tree with vulnerable transitive dependencies flagged, and a single SHIP/CAUTION/BLOCK verdict combining CVEs, licence risk and maintainer health — `security_fetch_package_vulnerabilities`, `security_fetch_dependency_graph`, `security_fetch_package_risk_brief`
- SBOM auditing against a CycloneDX or SPDX document — one-off, registered for continuous re-checking as new CVEs appear, or audited against a custom licence policy returning PASS/WARN/BLOCK per package — `security_audit_sbom_vulnerabilities`, `security_audit_sbom_continuous`, `security_audit_sbom_license_policy`
- Licence intelligence in plain English: what an SPDX identifier permits and obliges, and a compatibility audit naming the specific conflicting pairs with remediation — `security_fetch_licence_analysis`, `security_audit_licence_compatibility`
- Supply-chain signals beyond CVEs — maintainer ownership timelines with an anomaly score for sudden transfers, and typosquat detection by edit distance against the package corpus — `security_fetch_package_maintainer_history`, `security_detect_typosquatting`
- Frontend-specific tools scoped to npm: a manifest audit of your `package.json` with an optional lockfile for pinned accuracy, a CI-config scan for exposed secrets and unpinned actions that deliberately never flags proper secret references, and typosquat detection against a curated frontend corpus — `frontend_security_audit_manifest`, `frontend_security_audit_ci_pipeline`, `frontend_security_detect_typosquatting`
- A persistent CVE watchlist with a polling inbox that returns only what changed since your last check — `security_fetch_cve_watch`, `security_fetch_cve_watch_status`
- Nonprofit research from IRS and ProPublica data: a full 990-based due-diligence profile with health score and programme ratio, multi-year financial trends, and search by name, state or mission category, plus UK Charity Commission records — `nonprofit_fetch_nonprofit_full_profile`, `nonprofit_fetch_nonprofit_financial_trends`, `nonprofit_search_nonprofits_by_category`, `nonprofit_fetch_charity_uk`
- Compliance and identity checks: federal exclusion status on SAM.gov, healthcare provider lookup and search in the NPI registry, and FINRA broker registration with disclosures — `compliance_check_sam_exclusion`, `compliance_fetch_npi_provider`, `compliance_search_npi_by_name`, `compliance_fetch_finra_broker`
- Domain intelligence: DNS records, an A–F graded email-security check across SPF, DMARC and DKIM, registration details over RDAP, co-hosted domains, subdomain enumeration and certificate chains from transparency logs — `domain_fetch_dns_records`, `domain_check_email_security`, `domain_fetch_domain_rdap`, `domain_fetch_subdomains`, `domain_fetch_ssl_certificate_chain`
- Patents, federal contracts and regulatory dockets — patent records, keyword search, inventor portfolios and citation chains; vendor award history, award search and open solicitations; open rulemakings, docket detail and Federal Register notices — `legal_fetch_patent_by_number`, `legal_fetch_inventor_portfolio`, `govcon_fetch_vendor_contract_history`, `govcon_fetch_open_solicitations`, `regulatory_search_open_rulemakings`
Nothing to start: add the hosted HTTP endpoint and you get 100 calls a month anonymously, with no account and no card. Generating a free key from inside the client raises that to 500 a month — the key is issued to an email address, returned once, and passed thereafter in a header; rotation and revocation are tools of their own. There is also an npx path for stdio clients. Every response carries a usage field showing the month's count against your limit. Licence is BSL 1.1.
One command — npx -y @datanexusmcp/mcp-server