MCP distribution · 2026.10.22-rc1

Dependency-Track.
Ready for your test environment.

Run a local MCP server with 250 tools generated from the Dependency-Track 5.1.1 contracts. Inspect projects, components and findings, and exercise write workflows in your own sandbox.

Dependency-Track Full Sandbox

Signed release candidate

This profile allows writes permitted by your API key without an additional per-call confirmation enforced by the server. Start with a dedicated test instance.

Download MCP ZIP

ZIP signature Release manifest Manifest signature

ZIP SHA-256: 479b215796d462e1c2736bd0c2d3e0c91327e72a8dca15339935b0d30ad27bf6

Verify the ITYES signature before running the package →

Source available. Commercial licensing through ITYES.

The ITYES-authored code is licensed under PolyForm Noncommercial 1.0.0. Noncommercial purposes and the institutional uses specified by that license are permitted. Third-party materials retain their own licenses.

For commercial use outside those permissions, contact ITYES IT FACTORY S.R.L. for a separate written license and commercial terms. This is source-available software, not OSI-approved open source.

Install locally

Verify the signed ZIP using the trusted ITYES public key.
Extract it to a permanent directory. Use Node 22.6–22.x or 24.x.
Run npm ci --ignore-scripts, then copy .env.example to .env.
Set your Dependency-Track API URL and team API key locally. Keep MCPFORGE_ENVIRONMENT=sandbox.
Run npm run verify, then follow the included Codex host configuration.

The package runs on your computer. Speclara does not host your Dependency-Track instance or receive your API key through this download.

What we tested

Selected scenarios in Codex CLI covered inventory, pagination, CRUD, SBOM import, analysis, triage persistence and VEX export. The Python SBOM import contained 157 components. A larger frontend SBOM was imported manually, then inspected through MCP.

“Full” describes the included tool surface. It does not mean every tool or every supported platform has been exhaustively tested. Small local models have not yet been qualified for this release.

Known limits

JSON request bodies are limited to 1 MiB, including Base64 upload content.
Identical effects may be blocked for 300 seconds by the intentional replay guard.
Some write schemas require fields inherited from the upstream OpenAPI model.
Vulnerability results depend on your data sources and synchronization state.
The tested VEX export retained triage state but omitted the investigation comment.

The included installation and qualification documents describe the observed behavior in more detail.

Dependency-Track.Ready for your test environment.