# FOSSA MCP for AI Agents AI Agent Connect

> FOSSA MCP for managing license compliance and security vulnerabilities. It lets you list projects, inspect revisions, and track dependencies directly from your AI agent.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/ai-agent-connect
- **Tags:** open-source, license-compliance, vulnerability-scanning, dependency-management, software-audit

## Description

If you're tired of jumping between tabs to see which projects are using a specific library, this Connector changes that. You can just ask your agent to find every instance of a vulnerable dependency across your whole organization. It pulls the data directly from FOSSA so you can get answers without manual searching. It's a huge help if you're trying to build a software bill of materials or just need to know if a new package is safe to use. You'll find this is a core part of managing your software supply chain more effectively. Since Vinkius hosts this, you can get it running in your agent in minutes. You get to stop doing the heavy lifting of data gathering and start making actual decisions about your security posture. Instead of clicking through complex UI filters, you just state your requirement. Whether you need to check a specific revision or see every project using a certain locator, the agent handles the heavy lifting. This turns a tedious audit into a quick conversation. You'll spend less time hunting for data and more time actually fixing the issues that matter. You can get a clear picture of your risk surface without the friction of manual data entry or navigating complex dashboards. It's about getting the right info at the right time. It takes the guesswork out of compliance by providing direct access to the data you need to stay secure.

## Tools

### list_revisions
Use list_revisions to see the history of a project. It lets you browse through different versions to see how the software has evolved.

### list_projects
Use list_projects to view all projects in your organization. This tool supports filtering and pagination so you can quickly find specific workspaces.

### get_revision_dependencies
Use get_revision_dependencies to see the full dependency list for a specific version. It helps you understand the exact software bill of materials for any given revision.

### check_vulnerabilities
Use check_vulnerabilities to scan specific dependency locators for security issues. It gives you a direct look at risks without needing to browse the dashboard.

### get_revision
Use get_revision to pull the metadata for a specific project version. It provides the core details you need to inspect a revision's properties.

### get_parent_projects
Use get_parent_projects to find every project that contains a specific dependency. This is the fastest way to do an impact assessment when a package is flagged.

## Prompt Examples

**Prompt:** 
```
Which projects are using the dependency npm+coa$2.0.2?
```

**Response:** 
```
The dependency **npm+coa$2.0.2** is found in 3 parent projects:

* **Core-API**
* **Frontend-Dashboard**
* **Legacy-Auth-Service**

Would you like me to check these for vulnerabilities?
```

**Prompt:** 
```
Check for vulnerabilities in npm+ssh2$0.6.1.
```

**Response:** 
```
I've analyzed that locator. **npm+ssh2$0.6.1** has 2 critical vulnerabilities related to command injection. 

I can also check other dependencies if you'd like.
```

**Prompt:** 
```
List all projects in my FOSSA organization named 'DocsExample'.
```

**Response:** 
```
I've found the project: **custom+27932/DocsExample**.

Would you like to see its recent revisions or check for vulnerabilities?
```

## Capabilities

### Find every project using a specific library
Identify every instance of a vulnerable or non-compliant dependency across your entire organization.

### Audit project revisions for licenses
Check specific versions of your software for license compliance and metadata.

### Scan for security vulnerabilities
Query your dependency locators to find known security risks in a single request.

### View project metadata
Get detailed information about specific project revisions and version locators.

### List all organization projects
Browse all projects in your organization with support for pagination and filtering.

## Use Cases

### Rapid Vulnerability Impact Assessment
A security engineer finds a critical CVE in a common library and needs to know which 50 projects are affected. They ask the agent to find all parent projects using that locator.

### Automated License Compliance Audits
A legal team needs to verify the license of a new release. They ask the agent to list revisions for the project and check the metadata for the latest one.

### Software Bill of Materials (SBOM) Mapping
A developer wants to see the full dependency tree for a legacy app. They ask the agent to get the dependencies for a specific version.

### Organization-Wide Project Discovery
An architect needs a bird's eye view of all projects in the org. They ask the agent to list projects filtered by a specific department.

## Benefits

- Stop manual searching by getting a high level view of your entire organization's projects in one go.
- Identify security risks faster by scanning multiple dependency locators in a single query.
- Get a clear view of your software bill of materials by pulling the full dependency tree for any revision.
- Pinpoint exactly where a library is used across your stack to perform faster impact assessments.
- Save hours of manual audit work by pulling revision data and metadata directly into your agent's context.

## How It Works

The bottom line is you get to replace manual dashboard navigation with direct, natural language queries into your software supply chain.

1. Subscribe to the FOSSA MCP and provide your API token.
2. Connect the Connector to your AI client like Claude or Cursor.
3. Ask your agent to find vulnerabilities or list project dependencies in plain English.

## Frequently Asked Questions

**How does the FOSSA MCP help with license compliance?**
It lets you query your project revisions and metadata using natural language. You can quickly check if your software meets legal requirements without manually clicking through the FOSSA dashboard.

**Can I use the FOSSA MCP to find security vulnerabilities?**
Yes, you can ask your agent to scan specific dependency locators for known vulnerabilities. It returns a clear list of risks found in your software supply chain.

**Does the FOSSA MCP work with my existing FOSSA account?**
Yes, it connects directly to your existing FOSSA account using your API token. It gives your AI agent the ability to read and query your organization's data.

**How do I use the FOSSA MCP to audit my software supply chain?**
Once connected, you can simply ask your agent to list projects, pull dependency trees, or find every project using a specific library to identify risks across your organization.

**Can the FOSSA MCP show me which projects use a specific package?**
It can. You can ask the agent to identify all parent projects containing a specific dependency, which is perfect for understanding the impact of a security vulnerability.

**Can I find which projects are affected by a specific vulnerable package?**
Yes. Use the `get_parent_projects` tool with the dependency locator (e.g., `npm+coa$2.0.2`) to see every project in your organization that includes that specific dependency.

**How do I check for security vulnerabilities in a list of dependencies?**
You can use the `check_vulnerabilities` tool by providing an array of dependency locators. The agent will return any known security issues impacting those specific versions.

**Can I see the full dependency list for a specific project version?**
Absolutely. By using `get_revision_dependencies` with a revision locator, you can retrieve the complete list of dependencies identified by FOSSA for that specific build or release.