@meterian/mcp

Meterian MCP server — exposes security advisory lookups for open-source dependencies as MCP tools. Designed to be invoked by AI assistants (Claude, Codex, Gemini) as a Model Context Protocol server over stdio.

Quick start

npx @meterian/mcp

The server communicates over stdin/stdout using the MCP JSON-RPC protocol. It is not intended to be run interactively — configure your AI assistant to launch it automatically (see below).

Configuration

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "meterian": {
      "command": "npx",
      "args": ["-y", "@meterian/mcp"]
    }
  }
}

Claude CLI

claude mcp add meterian -- npx -y @meterian/mcp

Codex CLI

Edit ~/.codex/config.yaml:

mcpServers:
  meterian:
    command: npx
    args: ["-y", "@meterian/mcp"]

Gemini CLI

Edit ~/.gemini/settings.json:

{
  "mcpServers": {
    "meterian": {
      "command": "npx",
      "args": ["-y", "@meterian/mcp"]
    }
  }
}

GitHub Copilot coding agent

The GitHub Copilot coding agent (the autonomous agent that works on GitHub issues and creates PRs) supports MCP servers via .github/copilot/mcp.json in your repository. GitHub requires the type and tools keys.

Create or edit .github/copilot/mcp.json in your repository:

{
  "mcpServers": {
    "meterian": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@meterian/mcp"],
      "tools": ["advisories_get", "advisories_getnextsafe"]
    }
  }
}

Once added, the Copilot coding agent will automatically have access to Meterian's security advisory tools when working on issues in your repository.

Note: The GitHub Copilot coding agent supports MCP tools only — prompts (such as meterian-security-audit) are not supported and will be ignored.

Manual MCP config

{
  "mcpServers": {
    "meterian": {
      "command": "npx",
      "args": ["-y", "@meterian/mcp"]
    }
  }
}

Available tools

| Tool | Description | |------|-------------| | advisories_get | Returns all security advisories for a library (language, name, version) | | advisories_getnextsafe | Returns the next safe version at each semver level for a vulnerable library |

Available prompts

| Prompt | Description | |--------|-------------| | meterian-security-audit | System prompt that instructs the AI to perform a Meterian security audit |

Changelog

1.20.15 — 2026-06-05

• Fix: MCP server now reliably exits when the parent process terminates (VS Code crash, SIGKILL, or abrupt exit). Added stdin 'close' handler and a 5-second parent-PID watchdog.

1.20.14 — 2026-06-03

• Fixed: MCP server process now exits when the client disconnects, preventing a CPU spin

1.20.13 — 2026-05-25

• Added GitHub Copilot coding agent configuration instructions to README

1.20.12 — 2026-05-22

• Initial standalone release of @meterian/mcp as a separate npm package