MCP server

Examples

Copy-paste prompts for your AI assistant and the Arachne tool calls they turn into, from a morning advisory check to an approved pull request.

Once Arachne is connected, talk to your assistant normally. These prompts work in any client; the tool calls listed are what a capable model typically makes. Your model decides the exact sequence, and your client may ask you to allow each call (allow the read tools freely; look closely before allowing fix_submit and pr_open).

What is affected by new advisories?#

What in my repos is affected by new advisories? Start with anything in CISA KEV.

1. repos_affected {"kev_only": true}, then again with {} (following next_cursor if you have more than 5 repos).
2. advisory_explain for each distinct advisory, to describe impact and the fix.

A good answer groups findings by repo, puts KEV and high-EPSS items first, and says which have a known fixed version.

Fix one advisory, show me the evidence first#

Fix the requests advisory in aadhi0612/arachne-demo and show me the evidence before opening a PR.

1. repos_affected to find the project id and confirm the finding (requests 2.30.0, GHSA-j8r2-6x86-q33q).
2. propose_version {"project_id": "…", "package": "requests"} → 2.31.0, not a major bump.
3. fix_submit {"project_id": "…", "idempotency_key": "fix-requests-…"} → job_id, one use reserved.
4. job_status repeatedly until status is done; then it reports the outcome, confidence, chosen versions and the five gates.
5. The model stops and tells you to approve the PR in the web app (it cannot approve), then calls pr_open when you say so.

Am I exposed to this CVE?#

Is CVE-2023-32681 in any of my projects? If so, what version should I move to?

1. advisories_search {"query": "CVE-2023-32681"} resolves the alias to GHSA-j8r2-6x86-q33q.
2. advisory_explain with each project_id (or repos_affected first if the projects were never scanned).
3. propose_version for the affected package in each affected project.

Check a dependency before adding it#

I'm about to add lodash 4.17.15 to a project. Any advisories against that version, and which version is safe?

1. advisories_search {"ecosystem": "npm", "package": "lodash", "version": "4.17.15"}: only advisories that affect that version, each with fixed_versions.

No repository needed: this is a pure database lookup and costs nothing.

A daily advisory digest#

Give me today's new PyPI and npm advisories. Remember the cursor so tomorrow you only show what's new.

1. advisories_latest {"ecosystem": "PyPI", "limit": 50} and the same for npm.
2. Next time: advisories_latest {"ecosystem": "PyPI", "since_cursor": "<the previous next_cursor>"}.

Whether the cursor survives to tomorrow depends on your client's memory; you can also paste it back in yourself.

How many fixes do I have left?#

Before you fix anything: how many fixes do I have left this month, and what happens if I run out?

There is no dedicated usage tool. The model learns your usage from the usage object that fix_submit and pr_open return, or from a quota_exhausted error (with resets_at and the options upgrade, request_more, wait). The app's header always shows the live meter.

What a tool call looks like on the wire#

For the curious, this is the request your client sends for step 3 of the fix example, and what comes back:

// request
{"jsonrpc":"2.0","id":7,"method":"tools/call",
 "params":{"name":"fix_submit","arguments":{"project_id":"11111111-2222-4333-8444-555555555555","idempotency_key":"fix-requests-2026-11-14"}}}

// response
{"jsonrpc":"2.0","id":7,"result":{"content":[{"type":"text",
 "text":"{\"job_id\": \"aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee\", \"created\": true, \"usage\": {\"allowance\": 3, \"consumed\": 0, \"reserved\": 1, \"remaining\": 2, \"resets_at\": \"2026-12-01T00:00:00+00:00\", \"plan\": \"hatchling\"}}"}]}}