Lynk-MCP is a server designed for the Interlynk API, enabling AI assistants to interact with Lynk organizations. It streamlines operations such as Software Bill-of-Materials (SBOM) management, vulnerability tracking, and compliance checking, empowering users to address critical security needs efficiently.
Key Features:
Natural Language Queries: Enables users to ask questions in plain English for instant insights into vulnerabilities, compliance status, and more.
Multi-Product Analysis: Allows querying across multiple products to identify shared vulnerabilities or compliance issues.
Drift Analysis: Compares SBOM versions to highlight changes in components, vulnerabilities, or licenses over time.
Compliance Tracking: Monitors policy violations and license management to ensure adherence to security standards.
Compatibility: Works seamlessly with AI platforms like Claude Desktop, VS Code Copilot, Cursor, and Zed.
Audience & Benefit:
Ideal for DevSecOps teams, security engineers, and organizations managing complex software supply chains, Lynk-MCP simplifies vulnerability management and compliance monitoring. It empowers users to make informed decisions using real-time data, reducing risk and enhancing overall security posture.
Lynk-MCP can be installed via winget for easy setup on Windows systems.
MCP server for Interlynk API. This server enables AI assistants like Claude, Cursor, and VS Code Copilot to interact with your Lynk organization for SBOM management, vulnerability tracking, and compliance checking.
Quick Start
# Install via Homebrew on macOS
brew install --cask interlynk-io/interlynk/lynk-mcp
# Configure your API token
lynk-mcp configure
# Verify connection
lynk-mcp verify
Then add to your AI assistant and start asking questions about your SBOMs!
Why lynk-mcp?
Managing software supply chain security is complex. With lynk-mcp, you can use natural language to:
Query vulnerabilities instantly - "Show me all critical CVEs affecting my products"
Track compliance - "Which products are failing security policies?"
Analyze drift - "What changed between these two versions?"
Generate reports - "Create a security summary for the executive team"
Search across SBOMs - "Find all instances of log4j in my organization"
Key Features
Natural Language Queries: Ask questions in plain English
Multi-Product Analysis: Search vulnerabilities across your entire organization
Version Comparison: Drift analysis between SBOM versions
Compliance Tracking: Policy violations and license management
Works Everywhere: Claude Desktop, Claude Code, VS Code, Cursor, Zed
Example Queries
Once configured with your AI assistant, try these:
Vulnerability Analysis
"Show me all critical vulnerabilities in my organization"
"List vulnerabilities with KEV (Known Exploited Vulnerabilities) status"
"What vulnerabilities in [product] have a fix available?"
"Which components have the most vulnerabilities?"
Searching for Specific Attacks & CVEs
"Are any of my products affected by the XZ backdoor (CVE-2024-3094)?"
"Check if my organization is vulnerable to Log4Shell (CVE-2021-44228)"
"Search for any components affected by CVE-2023-44487 (HTTP/2 Rapid Reset)"
"Find all occurrences of OpenSSL vulnerabilities in my SBOMs"
Security Reports
"Generate a security summary for [product] with all critical vulnerabilities"
"Create an executive summary of our vulnerability posture"
"List all components with known vulnerabilities grouped by severity"
"Summarize vulnerability trends between the last two versions"
"Compare the last two versions of [product] and highlight security changes"
"What new vulnerabilities were introduced in the latest version?"
"Show me components that were added or removed between versions"
"Has our security posture improved since the last release?"
Policy & Compliance
"What policies are currently failing for [environment]?"
"Show me all versions that violate security policies"
"List all components using GPL licenses"
"Which products have deprecated licenses?"
Component Analysis
"Find all instances of log4j across my organization"
"List all components from [vendor]"
"Show me direct vs transitive dependencies in [version]"
"Which components are missing PURL identifiers?"
Linux packages are built automatically on every release. A hosted apt, yum, or apk repository is not currently published, so package-manager upgrades require installing the newer release package.
The release workflow opens a PR for the Scoop bucket manifest and a winget package manifest PR when a new tag is published.
Go Install
go install github.com/interlynk-io/lynk-mcp/cmd/lynk-mcp@latest
Docker
# Pull from GitHub Container Registry
docker pull ghcr.io/interlynk-io/lynk-mcp:latest
# Run with API token
docker run -e LYNK_API_TOKEN=lynk_live_xxx ghcr.io/interlynk-io/lynk-mcp serve
From Source
git clone https://github.com/interlynk-io/lynk-mcp.git
cd lynk-mcp
make build
The binary is placed in ./build/lynk-mcp. You can run it directly from there, or run make install to install it to $GOPATH/bin (typically ~/go/bin) and use it from anywhere.
Release Automation
Tagged releases publish binaries, archives, checksums, Linux packages, Docker images, and package-manager manifests. The release workflow expects these repository secrets when package-manager publishing is enabled:
Secret
Purpose
INTERLYNK_RELEASE_GITHUB_TOKEN
Opens Homebrew, Scoop, and winget manifest PRs
INTERLYNK_RELEASE_SSH_KEY
Pushes signed Homebrew/Scoop PR branches to interlynk-io/homebrew-interlynk
INTERLYNK_RELEASE_GPG_PRIVATE_KEY
Imports the release signing key used for tap commits
INTERLYNK_RELEASE_GPG_PASSPHRASE
Unlocks the release signing key
The public key for INTERLYNK_RELEASE_GPG_PRIVATE_KEY must be uploaded to the GitHub account that owns the interlynk-support-bot commit identity so GitHub marks tap PR commits as verified. See Release Distribution for the shared release model used across Interlynk OSS tools.
Get current organization information including metrics
list_products
List all products in the organization
get_product
Get details of a specific product including its environments
list_environments
List environments within a product
get_environment
Get details of a specific environment
list_products supports cursor pagination with limit and after. Responses include hasMore and endCursor; pass endCursor as after to fetch the next page.
Product responses include lightweight repository import metadata when available. list_products also includes a compact Jira defaults summary; get_product, list_environments, and get_environment include per-environment jiraDefaults without invoking the heavier ticketing status scan.
Versions & SBOM
Tool
Description
list_versions
List versions in an environment
get_version
Get version details with statistics
find_version
Find versions by exact version string with optional product/environment disambiguation
download_sbom
Download SBOM content with configurable format, vulnerabilities, files, lite/original, support status, and latest-version lookup
compare_versions
Compare two versions and show drift analysis
get_version can include a per-component vulnerability summary with include_component_vuln_summary=true. download_sbom returns ready, processing status, filename/content type, content length, and content unless include_content=false; provide version_id directly or product/environment details to resolve the latest version.
List vulnerabilities in a version with optional filters
get_vulnerability
Get vulnerability details by CVE or UUID
search_vulnerabilities
Search across all products
list_vulnerabilities supports cursor pagination with limit and after. Responses include hasMore and endCursor; pass endCursor as after to fetch the next page.
list_vulnerabilities can filter a version by component_id or exact component purl. search_vulnerabilities can filter across the organization by component_id, component_ids, or exact purl, and supports after/endCursor pagination.
Vulnerability responses include both fixedIn and fixedVersions; prefer fixedVersions when present because it is structured.
Vulnerability responses include customFieldAttributes when component vulnerability custom fields are present. Each attribute includes its value, field definition ID, and definition metadata such as displayName, internalName, and fieldType.
VEX
Tool
Description
list_vex_statuses
List VEX statuses with UUIDs for CVE triage
list_vex_justifications
List VEX justifications with UUIDs for CVE triage
update_component_vex
Update VEX data for a component vulnerability; requires confirm=true
bulk_update_component_vex
Update VEX data for multiple component vulnerabilities with one shared payload; requires confirm=true
Use component_vuln_custom_field_attributes on update_component_vex or bulk_update_component_vex to update custom VEX fields. Pass componentVulnCustomFieldDefinitionId and value to set a field, include id when updating an existing attribute, or pass _destroy: true with id to remove one.
Supply-Chain Security Incidents
Tool
Description
list_security_incidents
List supply-chain security incidents visible to the current organization
get_security_incident
Get a supply-chain security incident, including markers and impact state
create_security_incident
Create a draft security incident; requires operator permissions and confirm=true
update_security_incident
Update editable security incident fields; requires operator permissions and confirm=true
add_security_incident_markers
Add markers to a security incident; requires confirm=true
withdraw_security_incident_markers
Withdraw active markers and resolve related active findings; requires confirm=true
publish_security_incident
Publish a draft incident and queue the initial impact scan; requires confirm=true
resolve_security_incident
Resolve an active security incident; requires confirm=true
archive_security_incident
Archive a security incident; requires confirm=true
create_security_incident_update
Add a timeline update to a security incident; requires operator permissions and confirm=true
get_security_incident_findings
Get customer-facing findings for a security incident in the current organization
suppress_security_incident_finding
Suppress a security incident finding; requires confirm=true and a reason
rerun_security_incident_impact_scan
Queue impact scanning for an active or resolved incident; requires confirm=true
dry_run_security_incident_impact_scan
Queue a dry-run impact scan for an incident; requires confirm=true
get_security_incident_dry_run_result
Get latest dry-run impact scan results
Policies
Tool
Description
list_policies
List security policies
get_policy
Get policy details with rules
list_policy_violations
List policy evaluation results
Ticketing
Tool
Description
get_ticketing_status
Get ticketing provider connection and policy application status
get_ticketing_status supports independent cursors for products, policies, and created-ticket scans with products_after, policies_after, and ticket_links_after. Responses include productsEndCursor, policiesEndCursor, and ticketsEndCursor. Set include_created_tickets=false for configuration-only lookups that should skip the component vulnerability ticket-link scan.
Licenses
Tool
Description
list_licenses
List licenses with filtering
Available Resources
Resource URI
Description
version:///{version_id}
Complete version information
version:///{version_id}/components
All components in a version
version:///{version_id}/vulnerabilities
All vulnerabilities in a version
version:///{version_id}/doctor-results
SBOM Doctor findings for a version
environment:///{environment_id}/latest-version
Most recent version
organization:///summary
Organization overview
vulnerability:///{cve_id}
Vulnerability details by CVE
Security
API tokens stored in system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
Tokens never logged or exposed
All API communication uses HTTPS
Organization scoping enforced by Lynk API
Development
Prerequisites
Go 1.24 or later
Building
make build # Build for current platform
make install # Build and install to $GOPATH/bin
make build-all # Build for all platforms
make test # Run tests
make lint # Run linter
Project Structure
lynk-mcp/
├── cmd/lynk-mcp/ # CLI entry point
├── internal/
│ ├── api/ # High-level API client
│ ├── config/ # Configuration and keyring
│ ├── graphql/ # GraphQL client and queries
│ └── mcp/ # MCP server implementation
├── Dockerfile # Multi-platform container build
├── go.mod
├── Makefile
└── README.md