Supplyscan MCP

补给扫描

JavaScript锁文件的安全扫描程序——检测供应链漏洞和已知漏洞。

快速开始 · 安装 · 命令行用法 · MCP服务器 · 数据源

______________________________________________________________________

快速开始

brew install seanhalberthal/tap/supplyscan

supplyscan scan                       # scan current directory
supplyscan check lodash 4.17.20      # check a specific package

______________________________________________________________________

特性

• 供应链检测 --从DataDog、GitHub咨询数据库和OSV.dev聚合IOC
• 漏洞扫描 -与已知CVE的npm审计API集成
• 多格式锁文件 --npm、Yarn（经典和浆果）、pnpm、Bun和Deno
• 双接口 --具有样式输出的独立CLI，或用于AI代理的MCP服务器
• CI/CD友好 --用于脚本编写和自动化的JSON输出模式
• 每个源缓存 --每个IOC源都使用可配置的TTL独立缓存

支持的锁定文件

内置Go而不是作为npm包，使其在设计上不受npm供应链攻击。

______________________________________________________________________

安装

家酿

brew install seanhalberthal/tap/supplyscan

去安装

go install github.com/seanhalberthal/supplyscan/cmd/supplyscan@latest

需要Go 1.26+和 $GOPATH/bin 在你的路径。

Download binary

预构建的二进制文件可从以下网址获得 :

# macOS (Apple Silicon)
curl -L https://github.com/seanhalberthal/supplyscan/releases/latest/download/supplyscan-darwin-arm64 \
  -o /usr/local/bin/supplyscan && chmod +x /usr/local/bin/supplyscan

# macOS (Intel)
curl -L https://github.com/seanhalberthal/supplyscan/releases/latest/download/supplyscan-darwin-amd64 \
  -o /usr/local/bin/supplyscan && chmod +x /usr/local/bin/supplyscan

# Linux (x64)
curl -L https://github.com/seanhalberthal/supplyscan/releases/latest/download/supplyscan-linux-amd64 \
  -o /usr/local/bin/supplyscan && chmod +x /usr/local/bin/supplyscan

Build from source

git clone https://github.com/seanhalberthal/supplyscan.git
cd supplyscan
go build -o supplyscan ./cmd/supplyscan
mv supplyscan /usr/local/bin/

______________________________________________________________________

命令行用法

CLI是默认模式，不需要任何标志。

# Scan current directory
supplyscan scan

# Scan specific path recursively
supplyscan scan /path/to/monorepo --recursive
supplyscan scan /path/to/monorepo -r  # short form

# Scan production dependencies only (exclude devDependencies)
supplyscan scan --no-dev

# Combine flags
supplyscan scan /path/to/monorepo -r --no-dev

# Check a specific package
supplyscan check lodash 4.17.20

# Refresh IOC database
supplyscan refresh
supplyscan refresh --force  # force update even if cache is fresh

# Show status
supplyscan status

# Output raw JSON (for scripting/CI)
supplyscan scan --json
supplyscan check lodash 4.17.20 --json

# Show help
supplyscan help

______________________________________________________________________

MCP服务器集成

对于AI代理集成（Claude Code、Cursor等），供应商可以作为MCP服务器运行 --mcp 旗帜。

克劳德代码

brew install seanhalberthal/tap/supplyscan && \
claude mcp add mcp-supplyscan --transport stdio -s user -- supplyscan --mcp

克劳德桌面/光标/其他客户端

添加到MCP配置文件中：

{
  "mcpServers": {
    "mcp-supplyscan": {
      "command": "supplyscan",
      "args": ["--mcp"]
    }
  }
}

MCP工具

Tool parameters

supplyscan_scan

supplyscan_check

supplyscan_refresh

______________________________________________________________________

更新

# Homebrew
brew upgrade supplyscan

# Go
go install github.com/seanhalberthal/supplyscan/cmd/supplyscan@latest

使用 supplyscan status （CLI）或 supplyscan_status （MCP）检查您当前的版本。

______________________________________________________________________

数据源

IOC来源（汇总）

• Datadog IOC数据库 — 妥协指标 --Shai Hulud活动套餐
• GitHub咨询数据库 — 安全公告 --npm恶意软件公告（GHSA）
• OSV.dev — 开源漏洞 --MAL生态系统中的npm恶意软件条目

漏洞数据

• npm审计API — 注册表审核端点 --已知CVE

______________________________________________________________________

Docker

如果你更喜欢容器化执行，supplyscan可以作为Docker镜像提供。请注意，您必须将项目目录装载到容器中。

通过Docker进行CLI

# Scan a directory
docker run --rm -v "$PWD:$PWD:ro" ghcr.io/seanhalberthal/supplyscan:latest \
  scan "$PWD"

# Check a specific package (no mount needed)
docker run --rm ghcr.io/seanhalberthal/supplyscan:latest \
  check lodash 4.17.20

MCP通过Docker

claude mcp add mcp-supplyscan --transport stdio -s user -- \
  docker run --rm -i --pull always \
  -v "$PWD:$PWD:ro" \
  ghcr.io/seanhalberthal/supplyscan:latest --mcp

或者添加到MCP配置文件中：

{
  "mcpServers": {
    "mcp-supplyscan": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "--pull", "always",
        "-v", "/path/to/your/projects:/path/to/your/projects:ro",
        "ghcr.io/seanhalberthal/supplyscan:latest",
        "--mcp"
      ]
    }
  }
}

替换 /path/to/your/projects 该目录包含您的项目。装载在容器内使用相同的路径，因此文件路径可以无缝工作。

______________________________________________________________________

许可证

麻省理工学院