Can I find which projects are affected by a specific vulnerable package?

Yes. Use the `get_parent_projects` tool with the dependency locator (e.g., `npm+coa$2.0.2`) to see every project in your organization that includes that specific dependency.

How do I check for security vulnerabilities in a list of dependencies?

You can use the `check_vulnerabilities` tool by providing an array of dependency locators. The agent will return any known security issues impacting those specific versions.

Can I see the full dependency list for a specific project version?

Absolutely. By using `get_revision_dependencies` with a revision locator, you can retrieve the complete list of dependencies identified by FOSSA for that specific build or release.

FOSSA (License Compliance) MCP Connector for Claude

Manage license compliance and security vulnerabilities via FOSSA — list projects, inspect revisions, and track dependencies directly from your AI agent.

6 tools Official Updated Jun 28, 2026 Official Vinkius Partner

More Details Connect to Claude

Connect your FOSSA account to any AI agent to automate open-source license compliance and security auditing through natural language.

What you can do

Project Overview — List all projects in your organization with support for filtering and pagination.
Revision Tracking — Access specific project revisions and fetch detailed metadata for any version locator.
Dependency Analysis — Deep-dive into the dependency tree of any revision to understand your software bill of materials (SBOM).
Impact Assessment — Identify every parent project that contains a specific vulnerable or non-compliant dependency.
Vulnerability Scanning — Check for security vulnerabilities across multiple dependency locators in a single query.

How it works

Subscribe to this server
Enter your FOSSA API Token
Start auditing your software supply chain from Claude, Cursor, or any MCP client

Who is this for?

Security Engineers — quickly identify where vulnerable packages are used across the entire organization.
Legal & Compliance Teams — audit project revisions for license compliance without manually navigating the FOSSA UI.
DevOps & Architects — verify dependency trees and project metadata directly from the terminal or code editor.

open-sourcelicense-compliancevulnerability-scanningdependency-managementsoftware-audit

Connect to Claude

Subscribe on Vinkius, then add this connector to Claude.ai or Claude Code.

① Claude.ai (web app)

Go to Settings → Connectors → Add custom connector
Paste the MCP endpoint URL below

https://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/mcp

② Claude Code (terminal)

claude mcp add --transport http fossa-license-compliance https://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/mcp

③ Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "fossa-license-compliance": {
      "url": "https://edge.vinkius.com/vk_preview_OrrKjBZcQcoQ9lOxWynXvkokseUtlrQY2s1yYaDD/mcp"
    }
  }
}

Get full access on Vinkius

The preview token above works for testing. Powered by Vinkius.