{"name":"aisecwatch-mcp","version":"1.0.0","protocolVersion":"2025-03-26","transport":"http","endpoint":"/api/mcp","description":"POST JSON-RPC 2.0 requests to this endpoint. Supported methods: initialize, tools/list, tools/call, ping.","tools":[{"name":"search_issues","description":"Search AI/LLM security issues with filters. Returns a list of matching issues with title, severity, CVE ID, summary, and source URL. Use this to look up recent vulnerabilities, research, or news on a topic."},{"name":"get_issue","description":"Fetch full details for a single record by its CVE identifier (CVE-2026-1234), its GHSA identifier (GHSA-xxxx-xxxx-xxxx) or its record UUID. Use this when you already hold one of these identifiers; use search_issues to find records by topic. Returns the complete public field set including CVSS vector, EPSS score, CWE IDs, affected packages/vendors, attack types, and mitigation."},{"name":"scan_stack","description":"Scan a developer's stack (list of package names and/or vendor names) against the issue database and return matching open security issues. Use this when you have only package or vendor names. When you have the contents of a manifest, lockfile or SBOM, use check_stack instead, which checks the exact versions the file pins."},{"name":"latest_digest","description":"Get the latest daily AI/LLM security TLDR digest as Markdown. Use this to summarize recent activity without running multiple searches."},{"name":"check_stack","description":"Run Stack Check on a project's dependency files. Pass the text of up to 5 manifests, lockfiles or SBOMs (package-lock.json, package.json, pnpm-lock.yaml, yarn.lock, requirements.txt, pyproject.toml, poetry.lock, uv.lock, Pipfile.lock, go.mod, go.sum, Cargo.toml, Cargo.lock, or a CycloneDX or SPDX JSON SBOM). Returns a Markdown report: known vulnerabilities in the pinned versions (from OSV) with fixed versions, LLM SDKs, agent frameworks and MCP components, dependencies that reach an LLM component indirectly, the host authority the dependencies grant, and recommended controls. Use this when you have the contents of a manifest, lockfile or SBOM, for example before adding or upgrading AI dependencies. When you have only package or vendor names, use scan_stack instead. Files are processed in memory and not stored; package names and versions are sent to osv.dev unless osv is false."},{"name":"check_llm_exposure","description":"Look up an open-source package in the AI Sec Watch Exposure Registry: whether it declares an LLM SDK, agent framework or MCP dependency and since which release, the host authority its dependencies grant (shell, file system, browser, HTTP, code execution, MCP tools), the dependency path if it reaches an LLM package indirectly, and advisories that name it. Accepts 'pypi:name', 'npm:@scope/name', or a bare name with the ecosystem argument."}]}