1. Conduid
  2. Science
  3. Dtrack MCP
MCP server · Science

Dtrack MCP

· github.com/drewrukin/dtrack-mcp

Read-mostly MCP server for Dependency-Track: AI-powered vulnerability triage with alias dedup, cross-project duplicate discovery, diff + carry-over between versions, and broadcast triage.

Unclaimed cvecyclonedxdependency-trackmcpmodel-context-protocolmodel-context-protocol-serverssbomsecurity-toolsvexvulnerability-triage
InstallView source
34Low

Scored a month ago · breakdown

About Dtrack MCP

Dtrack MCP is an MCP server in the Science category: read-mostly MCP server for Dependency-Track: AI-powered vulnerability triage with alias dedup, cross-project duplicate discovery, diff + carry-over between versions, and broadcast triage.

Install

From source
git clone https://github.com/drewrukin/dtrack-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (14)

broadcast_triage⚠ WRITE — fan out one decision to all versions of a project

Parameters not published.

carry_over_triage⚠ WRITE — transfer decisions v1 → v2 (or v2 → v1)

Parameters not published.

diff_findingsCarried / updated / new / gone between two versions

Parameters not published.

find_duplicate_analysesSame vuln in other components / projects, with prior analyses

Parameters not published.

find_vulnerabilityFull detail by id, optionally specifying source

Parameters not published.

get_analysisCurrent triage state + full comment history

Parameters not published.

get_project_versionsAll versions of a project, newest first

Parameters not published.

group_findings_by_aliasDeduplicate CVE/GHSA/OSV via union-find

Parameters not published.

list_findingsFindings with severity / state / suppressed filters

Parameters not published.

list_projectsList projects with vulnerability counts

Parameters not published.

Show all 14 tools
resolve_projectFind project by UUID or by exact name + version

Parameters not published.

search_vulnerabilityWhich projects are affected by a given CVE?

Parameters not published.

set_analysis⚠ WRITE — set state, justification, response, comment. Accepts raw UUIDs or a finding dict

Parameters not published.

upload_bom⚠ WRITE — upload CycloneDX/SPDX SBOM

Parameters not published.

Ask AI

✦

Ask AI about Dtrack MCP

Powered by Claude · Grounded in docs

I know everything about Dtrack MCP. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Dtrack MCP

How do I install Dtrack MCP?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Dtrack MCP safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Dtrack MCP still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.