---
title: ToolRouter — Tool Detail
description: Detailed documentation for a ToolRouter tool including skills, parameters, and examples.
url: https://toolrouter.com/tools/supply-chain-risk
---
# Supply Chain Risk

Audit open-source package versions for advisories, exploited CVEs, and dependency exposure across major ecosystems. Score one package, batch-audit a package list, inspect supported dependency graphs, or fetch full advisory records.

- **Version:** 0.02
- **Categories:** security, development, analytics
- **Author:** Humanleap (https://toolrouter.com)
- **License:** UNLICENSED
- **Repository:** https://github.com/Humanleap/toolrouter.git
- **Homepage:** https://toolrouter.com/tools/supply-chain-risk
- **Workflow:** package_risk → batch_risk → dependency_graph → package_risk → advisory_details → dependency_graph → advisory_details

## Skills (4)

### Package Risk (`package_risk`)

Assess the security risk of one exact package version. Returns advisories, severity counts, KEV hits, exploitability signals, provenance, repository health, fixed versions, and a deterministic risk score.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `package_url` | string | No | Package URL including version (preferred). Example: pkg:npm/lodash@4.17.20 or pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1 |
| `ecosystem` | string | No | Package ecosystem when not using package_url. Common values: npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Debian, Ubuntu, Alpine. |
| `name` | string | No | Package name when not using package_url. Maven uses group:artifact (for example org.apache.logging.log4j:log4j-core). |
| `version` | string | No | Exact package version when not using package_url. |
| `include_latest` | boolean | No | Look up the latest known version from deps.dev when the ecosystem supports it. [default: true] |
| `page` | number | No | Page number for advisory pagination (default 1). [default: 1] |
| `per_page` | number | No | Number of advisories to return per page (default 10, max 25). [default: 10] |

**Returns:** Risk score, severity breakdown, KEV hits, package metadata, and paginated advisory details for one package version

**Examples:**

*Audit a vulnerable lodash release by package URL:*

```json
{
  "package_url": "pkg:npm/lodash@4.17.20"
}
```

*Audit a vulnerable Log4j core release:*

```json
{
  "ecosystem": "Maven",
  "name": "org.apache.logging.log4j:log4j-core",
  "version": "2.14.1"
}
```

### Batch Risk Audit (`batch_risk`)

Audit up to 10 exact package versions in one request. Returns a sortable table with risk scores, advisory counts, KEV hits, exploitability signals, provenance, and repository health.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `packages` | array | Yes | List of package descriptors. Each item supports package_url or ecosystem, name, and version. Max 10 items. |
| `per_package_limit` | number | No | How many advisory records to load internally per package for scoring (default 5, max 25). [default: 5] |

**Returns:** A ranked table of package versions with risk scores, advisory counts, KEV hits, and severity breakdowns

**Examples:**

*Audit a mixed npm and PyPI package list:*

```json
{
  "packages": [
    {
      "package_url": "pkg:npm/lodash@4.17.20"
    },
    {
      "package_url": "pkg:pypi/django@5.0.3"
    }
  ]
}
```

*Audit Maven and NuGet packages together:*

```json
{
  "packages": [
    {
      "ecosystem": "Maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "version": "2.14.1"
    },
    {
      "ecosystem": "NuGet",
      "name": "Newtonsoft.Json",
      "version": "13.0.1"
    }
  ]
}
```

### Dependency Graph (`dependency_graph`)

Fetch the dependency graph for one package version on ecosystems supported by deps.dev. Returns direct and transitive dependencies with per-node vulnerability counts from OSV, plus vulnerable paths and remediation candidates.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `package_url` | string | No | Package URL including version. Best for npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems packages. |
| `ecosystem` | string | No | deps.dev-supported ecosystem when not using package_url: npm, pypi, go, cargo, maven, nuget, or rubygems. |
| `name` | string | No | Package name when not using package_url. |
| `version` | string | No | Exact package version when not using package_url. |
| `depth` | number | No | Dependency graph depth for deps.dev (default 3, max 6). [default: 3] |
| `max_nodes` | number | No | Maximum dependency nodes to return in the response table (default 100, max 150). [default: 100] |

**Returns:** Dependency graph nodes with direct or indirect relation types, vulnerable paths, and remediation candidates

**Examples:**

*Inspect the React dependency graph:*

```json
{
  "package_url": "pkg:npm/react@18.2.0"
}
```

*Inspect a Go dependency graph:*

```json
{
  "ecosystem": "Go",
  "name": "github.com/gin-gonic/gin",
  "version": "v1.10.0"
}
```

### Advisory Details (`advisory_details`)

Open a single advisory by ID. Works well for GHSA, CVE, and ecosystem-specific IDs and returns aliases, affected packages, fixed versions, KEV status, exploitability, and GitHub-reviewed metadata when available.

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `advisory_id` | string | Yes | Exact advisory identifier, for example GHSA-29mw-wpgm-hmr9, CVE-2020-28500, or PYSEC-2024-57. |

**Returns:** One advisory record with aliases, affected packages, fixed versions, KEV enrichment, exploitability, and source metadata when available

**Examples:**

*Open a GitHub security advisory:*

```json
{
  "advisory_id": "GHSA-29mw-wpgm-hmr9"
}
```

*Open a Python advisory by PYSEC ID:*

```json
{
  "advisory_id": "PYSEC-2024-57"
}
```

## Quick Start

```bash
# Via CLI
TOOLROUTER_API_KEY=tr_live_xxx npx -y toolrouter-mcp call supply-chain-risk package_risk --package_url pkg:npm/lodash@4.17.20

# Via REST API
curl -H "Authorization: Bearer tr_live_xxx" \
     -d '{"tool":"supply-chain-risk","skill":"package_risk","input":{"package_url":"pkg:npm/lodash@4.17.20"}}' \
     https://api.toolrouter.com/v1/tools/call
```

---

## Get Started with ToolRouter

**Already connected?** Call any tool with `use_tool({ tool, skill, input })`. Browse tools with `discover` or visit https://toolrouter.com/llms-full.txt

**New to ToolRouter?** Connect with one command (no API key needed — auto-provisions on first use):

```bash
# MCP (Claude Code, Codex CLI)
claude mcp add toolrouter -- npx -y toolrouter-mcp

# MCP (Cursor, Windsurf, Cline, VS Code, Gemini CLI, Claude Desktop)
{"mcpServers":{"toolrouter":{"command":"npx","args":["-y","toolrouter-mcp"]}}}

# Claude Chat / Claude Cowork / Claude Mobile — add as a connector:
# Settings → Connectors → Add custom connector → URL: https://api.toolrouter.com/mcp

# ChatGPT — add as an app:
# Settings → Apps → Advanced settings → enable Developer mode → Create app → MCP Server URL: https://api.toolrouter.com/mcp

# CLI (works instantly, no restart needed)
npx -y toolrouter-mcp tools                    # browse all tools
npx -y toolrouter-mcp search "seo"             # search by keyword
npx -y toolrouter-mcp call seo analyze_page --url https://example.com
```

Free tools work immediately. For paid tools, visit https://toolrouter.com/claim to add credits.

All platforms: https://toolrouter.com/connect | Full catalog: https://toolrouter.com/llms-full.txt | Docs: https://toolrouter.com/docs