The three tools are shaped for the moment a dependency gets added rather than for an audit run afterwards: ask for the latest safe version and you get one, ask about a pinned version and you get a definitive answer with CVSS attached. Nothing to install and no key, so the cost of leaving it switched on is close to nothing.
A remote MCP server over PyPI and OSV data. It answers three questions about Python dependencies — is this version vulnerable, what is the newest clean release, and which versions of this specifier are affected — with vulnerability ids, CVSS scores and severity attached.
- The most recent release of a package with no known vulnerabilities, from a package name alone — `most_recent_not_vulnerable`
- A verdict on an exact pinned version with vulnerability ids, summaries, CVSS scores, severity ratings and reference URLs — `is_vulnerable`
- Versions available for a package or specifier with their vulnerabilities, filtered by `cvss_threshold`, limited by `count`, reduced to `max_observed_score` per version, and optionally keeping clean versions with `retain_passing` — `lookup`
No local install and no key: this is a hosted HTTP endpoint. Register `https://mcp.fetter.io/mcp` with your client — `claude mcp add --transport http fetter https://mcp.fetter.io/mcp` for Claude Code, `codex mcp add fetter --url https://mcp.fetter.io/mcp` for Codex, or the same URL over HTTP transport anywhere else.
One command — claude mcp add --transport http fetter https://mcp.fetter.io/mcp