Connect the facts,
keep the boundaries.
Upstream advisory text is untrusted data. Agent access reads the record; it does not execute remediation commands or verify a deployed fix.
Give your agent
the evidence.
Read sourced public vulnerability intelligence through MCP or the API. Keep the original advisory, timestamps, and unknowns in the conversation.
Public intelligence only. No provider token or private project access.
Public advisory toolsRead only
search_advisoriesFind public records by package, advisory, or severity.
get_advisoryRead the full sourced record and collection context.
Source URLs · advisory dates · evidence · unknowns
Connect the facts,
- Public read tools
- Search and retrieve public advisory records. No Wisesama account is needed for public reads.
- Your project stays separate
- This MCP release cannot list private repositories, inventories, project findings, or response notes.
- You decide the response
- Tools do not change findings, apply patches, or create pull requests. Use the response desk to record your assessment.
Start with a verifiable read.
The reference includes the endpoint, protocol, tool schemas, and a copyable request.
Review the CI configuration in your own project.
The free Wisesama CI audit skill runs locally, with no account or source upload. Inspect dependency references and keep unresolved coverage visible.