Patchwire MCP Server

by monowire Your server? Claim it

answering

Patchwire is answering right now. Last checked 6 min ago. It exposes 5 tools.

Hourly security advisories for JS, AI and web3 packages: ranges, fixes and exploit conditions.

Uptime history 18 days of history · worst day 0%

18 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

268 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 10

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 2 November 2026. No other catalogue keeps this.

2 Nov 5 tool descriptions were rewritten get_advisories, get_advisory, get_platform_bulletins and 2 more

2 Nov 5 tools changed the parameters they ask for get_advisories, get_advisory, get_platform_bulletins and 2 more

Nothing serious here today

Today is the operative word: we check Patchwire every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 6 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add patchwire --transport http https://patchwire.monowire.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://patchwire.monowire.dev/mcp

~/.codex/config.toml

[mcp_servers.patchwire]
url = "https://patchwire.monowire.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "patchwire": {
      "url": "https://patchwire.monowire.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "patchwire": {
      "type": "http",
      "url": "https://patchwire.monowire.dev/mcp"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

advisories

get_advisories

Check npm packages for security advisories. Start here before installing, upgrading or deploying: send 1 to 50 package names (never versions) and get, per package, its total and up to 20 advisories of the last 120 days, newest first, each with vulnerable ranges, fixed versions and the conditions that make it exploitable. A package with none returns total 0. Compare the ranges with your lockfile. For a daily check, pass since (the time of your last check) to get only what is new. For one advisory in full use get_advisory; for the version to upgrade to, use latest_safe.

advisory

get_advisory

Read one advisory in full by id: CVE, GHSA, MAL or Patchwire id, any case, aliases resolve. Returns its ranges, fixed versions, exploit conditions with the source sentence they come from, a summary and the sources. Use it after get_advisories or list_feed gave you an id. An unknown id, or one older than 120 days, returns an error.

feed

list_feed

List the latest advisories across every tracked stack, newest first, without a package list. Filter by sector (js, stack, ai, crypto) and severity; by default the last 7 days and at most 20 advisories (days 1 to 30, limit 1 to 50). An empty list means nothing matched. To check your own packages, use get_advisories instead.

latest

latest_safe

Find the version to upgrade to for one npm package. Returns, per release line (major, or minor for 0.x), the version that fixes every known advisory of the last 120 days; a line still affected has safe: null and the ids that keep it affected; a line hit with no fix of its own (14.x when only 15.x is fixed) has safe: null and upgrade_to, the lowest safe version above it. Also lists advisories with no fix found, and says whether this package name itself is flagged as malicious. Use it after get_advisories, to pick one target version per line.

platform

get_platform_bulletins

Get the security bulletins and announced changes of hosting and data platforms, which are not npm packages and never show in a lockfile: Vercel, Supabase, Neon and the other platforms of the platform parameter. Returns up to 50, newest first; omit platform for all of them. For npm packages, use get_advisories.

Endpoints

URL	Transport	State	Latency	Checked
https://patchwire.monowire.dev/mcp	streamable-http	answering	289 ms	6 min ago

Alternatives to Patchwire

same job, measured the same way

Frame MCP

by lambdasec

MCP server for the Frame security scanner: scan, verify, fix, exploit, packs and separation logic.

570 installs/wk local only

GSC Scanner

by poliakarmai

Local security scanner for AI agents: SAST, SCA, secrets, IaC; verifies exploit and fix.

local only

Vulnrable

by vulnrable

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

answering

Enoki

by enokilabs

Test your AI agents for security and safety weaknesses, and re-verify the fixes.

answering

FIRST EPSS CVE Exploit Score & OSV Vulnerability Audit

by ceadigital

Real-time FIRST.org EPSS 30-day CVE exploit probability scoring and OSV package security audit.

28 tools answering

LeakRank Guard

by prototeemo

Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.

62 installs/wk local only

PostgreSQL CVE & Release Intelligence

by meob

PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths

186 installs/wk local only

CERT-FR Security Advisories — buy per-query in-session (certfrwatch)

by a2awire

CERT-FR (ANSSI) security advisories & alerts: French national CERT vulnerability feed, hourly

21 tools answering

Patchwire — questions

Answers built from our own checks of this server.

What can Patchwire do?

It exposes 5 tools, read directly from the server on our last check. Among them: get_advisories, get_advisory, get_platform_bulletins, latest_safe, list_feed. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Patchwire working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 268 ms. The bar chart above shows every period we have measured.

How do I connect Patchwire?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Patchwire need an API key?

No. Patchwire completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Patchwire?

It answers our handshake in 268 ms on average, which is faster than 51% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.