MCP serverio.github.kaitzyy-dev/sighttrue

Advisories broken down by severity rather than counted, with identifiers and dates. Requires a key; see https://sighttrue.com/pricing.

Read a whole manifest and return every reading on record for it, ordered by how much a reviewer would want to know. One call instead of one per dependency. Requires a key; see http

For a container base image: its size, when it was last rebuilt, and whether the OS underneath it is still supported. Requires a key; see https://sighttrue.com/pricing.

Call this before adding a dependency. Returns only the facts a reviewer would be annoyed to discover afterwards: whether the publisher has withdrawn the package, whether it runs sc

Check whether a runtime, database or framework release is still receiving security fixes, and what to move to. Covers about two dozen products read daily from endoflife.date.

Read the current standing of one open-source package: downloads with the window they cover, OpenSSF scorecard, advisory count, licence, whether the repository is archived, and when

Recorded incidents for a hosting or API provider over a window, kept after the provider’s own status page dropped them.

Read a whole dependency list at once and report what is archived, what carries advisories, what has a source-available licence, and what has not been pushed to in a year. Use when

Hold two watched repositories against each other across downloads, OpenSSF scorecard, advisories, forks, stars and findings on record. Compares only; it does not pick a winner.

What changed for a set of packages since a given date, read from the daily archive. Requires a key; see https://sighttrue.com/pricing.

Whether the domains a package points at — homepage, funding, documentation — still resolve to a registered owner. Requires a key; see https://sighttrue.com/pricing.

Given a finding id, return what was measured, when, by whom, and the address it can be checked at. For an agent quoting a figure into a review. Requires a key; see https://sighttru

Find language models by price and context window, from a catalogue read daily across sixty providers. Use this before choosing a model: prices move without announcement and trainin

Packages that ask for funding, beside how heavily they are installed and how many people write them. Requires a key; see https://sighttrue.com/pricing.

For a technology tag: questions asked against questions answered, over time. Requires a key; see https://sighttrue.com/pricing.

List every reading this server can return, what each one measures, and which require a key. Call this first if unsure which tool answers a question.

Every recorded price for a model, with the date each was read. Requires a key; see https://sighttrue.com/pricing.

Models that were in the catalogue and no longer are, with the date last seen. Requires a key; see https://sighttrue.com/pricing.

How the published artefact size has moved over time. Returns the readings taken, not a verdict. Requires a key; see https://sighttrue.com/pricing.

A provider’s recorded incidents, grouped by the component that failed, over the whole archive rather than the window its status page shows. Requires a key; see https://sighttrue.co

When a provider last changed its terms or pricing page, from a stored fingerprint of the page. Requires a key; see https://sighttrue.com/pricing.

How long a provider takes to acknowledge an incident: the interval between an incident starting and its first public update. Requires a key; see https://sighttrue.com/pricing.

Recorded outages of the package registries themselves, kept after their status pages drop them. Requires a key; see https://sighttrue.com/pricing.

Support end dates for the runtimes a dependency set requires, including any already past. Requires a key; see https://sighttrue.com/pricing.

Find watched repositories whose name contains a string, with their current readings. Use it to discover what is covered before calling the other tools.

Days between an advisory being published and a release appearing that postdates it, per package and as a distribution. Requires a key; see https://sighttrue.com/pricing.

Whether a name is one edit away from a more widely installed package. States that both names exist; which one was meant is the caller’s call. Requires a key; see https://sighttrue.

Add a package to the caller’s own private watchlist, so later readings are about their stack rather than the public one. The list is private to the key that created it. Requires a

Everything that has changed across the caller’s private watchlist since a given date: withdrawals, licence changes, advisories, archived repositories and runtimes going out of supp

How many accounts hold publish rights on a package, as the registry lists them. Answers who can put code on your machine, which is a different question from who writes it. Requires

Packages whose own publisher has withdrawn them and which are still being installed heavily, with the download figure and the publisher’s notice. Requires a key; see https://sightt