Vinkius

FOSSA MCP. Audit your software supply chain, conversationally.

FOSSA License Compliance connects your open-source auditing tools directly to your AI client. It automates security vulnerability checks and license compliance reviews across entire software supply chains, letting you query project dependencies in natural language. Stop clicking through dashboards; start asking questions about where every piece of code comes from.

FOSSA MCP is compatible with Claude Claude
FOSSA MCP is compatible with ChatGPT ChatGPT
FOSSA MCP is compatible with Cursor Cursor
FOSSA MCP is compatible with Gemini Gemini
FOSSA MCP is compatible with Windsurf Windsurf
FOSSA MCP is compatible with VS Code VS Code
FOSSA MCP is compatible with JetBrains JetBrains
FOSSA MCP is compatible with Vercel Vercel
See Vinkius in Action

Give Claude and any AI agent real-world access

List all projects

Retrieves a list of every project in your organization, supporting filtering by criteria like department or status.

Analyze specific revisions

Gets detailed metadata for any version locator, allowing you to audit a project at a precise point in time.

Map dependency trees

Deep-dives into the full dependency list of a revision, building an accurate software bill of materials (SBOM).

Identify project impact areas

Determines which parent projects contain specific dependencies that are vulnerable or non-compliant.

Scan for vulnerabilities

Checks multiple dependency locators against the FOSSA database in a single query to find security risks.

View project history

Lists all available revisions for a given project, helping you track changes over time.

Waiting for input…

AI Agent
FOSSA

What AI agents can do with FOSSA (License Compliance) with 6 Tools

These tools let you list projects, inspect historical revisions, map complex dependencies, and run vulnerability scans across your entire organization's codebase.

Make your AI actually useful.

Add this MCP to Claude, Cursor, or Windsurf and your AI stops guessing. It gets real tools to look things up, take action, and handle the stuff you keep doing by hand.

Start using FOSSA (License Compliance) MCP

Check Vulnerabilities

Checks a list of package locators to see if any are known security vulnerabilities.

Get Revision

Fetches detailed metadata for a specific, named project revision.

Get Parent Projects

Finds all parent projects that incorporate a given dependency.

List Projects

Lists every project in your organization, with filtering options to narrow the...

Get Revision Dependencies

Retrieves the full dependency list for a specific version of a project.

List Revisions

Lists all available revisions (versions) that exist for a given project.

Security and governance baked right in.

Pick your AI client below to get set up. Just create a Vinkius account, subscribe, and you're instantly up and running. We handle the entire backend infrastructure, delivering out-of-the-box support for HTTPS Streamable, SSE, and OAuth2—zero messy routing required.

FOSSA MCP is compatible with Claude

Claude AI

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.

2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL:

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.

3

Start a conversation

Open a new chat. The FOSSA integration is available immediately — no restart needed.

Choose How to Get Started

Build a custom MCP for your own tools, or connect a ready-made integration from our catalog.

Build Your Own

Turn any API into an MCP. Import a spec, define Agent Skills, or deploy with MCPFusion.

  • Import from OpenAPI, Swagger, or YAML specs
  • Create Agent Skills with progressive disclosure
  • Deploy to edge with MCPFusion framework
  • Built in DLP, auth, and compliance on each call
  • Real time usage dashboard and cost metering
  • Publish to catalog or keep private
Start building

Make Your AI Do More

Start with FOSSA (License Compliance), then connect any of our 5,200+ other servers whenever your AI needs more. One click, no limits.

  • Use this MCP plus 5,200+ others, all in one place
  • Add new capabilities to your AI anytime you want
  • Connections are secured and governed automatically
  • Track usage and costs across all your servers
  • Works with Claude, ChatGPT, Cursor, and more
  • New servers added to the catalog weekly
FOSSA MCP server cover

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by FOSSA. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

VINKIUS CLOUD

Cloud Hosted

Managed infra

V8 Isolated

Sandboxed per request

Zero-Trust Proxy

No stored credentials

DLP Enforced

Policy on each call

GDPR Compliant

EU data residency

Token Compression

~60% cost reduction

Your data is protected. See how we built it.

The manual process of checking compliance is always chasing ghosts.

Right now, to audit your supply chain, you open the FOSSA web interface. You have to manually navigate from project list to specific revisions, then click through dependency trees, and finally run a separate vulnerability scan for every single library of concern. This process takes hours just to gather the data.

With this MCP connected via Vinkius, you skip all that clicking. You simply ask your agent: 'Show me all projects using version 1.2 of Library Z.' The system compiles the full answer—project list, revision status, and dependency map—and presents it back to you in plain language.

Get a complete project picture with FOSSA License Compliance.

You no longer need to copy-paste package names into separate forms or tabs. You use `get_revision_dependencies` and `list_projects` together, telling your agent exactly what you need for the whole system at once.

The difference is that data moves from siloed dashboards into a cohesive conversation. Your audit results are immediate and actionable, allowing engineers to patch vulnerabilities in minutes instead of days.

What FOSSA MCP does for your AI

Manually tracking open-source licenses or hunting down a single vulnerable dependency is a massive time sink. This MCP lets your AI client bypass the FOSSA web interface entirely. Instead, you talk to it naturally and get precise audit data for your whole organization's codebase. You can list every project, pinpoint exactly which parent applications rely on a risky package, or check dozens of dependencies for vulnerabilities all in one go.

When paired with Vinkius, this MCP becomes the central point for accessing enterprise-grade security intelligence from any compatible client. It takes deep, complex data—like dependency trees and revision metadata—and turns it into actionable answers you can use right away.

Built · Hosted · Managed by Vinkius FOSSA License Compliance MCP - Audit dependencies & licenses
Server ID 019e389b-01eb-735d-a35b-c5192044387b
Vinkius Inspector
Compliance Grade F
Score 3.6/100
Vinkius Inspector Badge — Score 3.6/100

Frequently asked questions about FOSSA MCP

How does FOSSA License Compliance MCP help with dependency auditing? +

It allows your agent to analyze the full dependency tree using get_revision_dependencies, which builds a complete Software Bill of Materials (SBOM) without you having to manually map out every layer.

Can I check vulnerabilities across multiple projects with FOSSA License Compliance MCP? +

Yes. You can first use list_projects to gather the targets, and then use check_vulnerabilities in a single query against those combined locators.

What if I need data from an old version of a project? +

You can't rely on current data. Use list_revisions to find the historical versions, and then use get_revision to pull metadata for that specific point in time.

Does FOSSA License Compliance MCP tell me which project owns a risky dependency? +

Absolutely. The get_parent_projects tool will search your entire organization and list every single parent application using the problematic package, solving the 'blast radius' problem.