MCP server for Interlynk API. This server enables AI assistants like Claude, Cursor, and VS Code Copilot to interact with your Lynk organization for SBOM management, vulnerability tracking, and compliance checking.

# Install via Homebrew
brew install interlynk-io/tap/lynk-mcp

# Configure your API token
lynk-mcp configure

# Verify connection
lynk-mcp verify

Then add to your AI assistant and start asking questions about your SBOMs!

Managing software supply chain security is complex. With lynk-mcp, you can use natural language to:

• Query vulnerabilities instantly - "Show me all critical CVEs affecting my products"
• Track compliance - "Which products are failing security policies?"
• Analyze drift - "What changed between these two versions?"
• Generate reports - "Create a security summary for the executive team"
• Search across SBOMs - "Find all instances of log4j in my organization"

• Natural Language Queries: Ask questions in plain English
• Multi-Product Analysis: Search vulnerabilities across your entire organization
• Version Comparison: Drift analysis between SBOM versions
• Compliance Tracking: Policy violations and license management
• Works Everywhere: Claude Desktop, Claude Code, VS Code, Cursor, Zed

Once configured with your AI assistant, try these:

"Show me all critical vulnerabilities in my organization"
"List vulnerabilities with KEV (Known Exploited Vulnerabilities) status"
"What vulnerabilities in [product] have a fix available?"
"Which components have the most vulnerabilities?"

"Are any of my products affected by the XZ backdoor (CVE-2024-3094)?"
"Check if my organization is vulnerable to Log4Shell (CVE-2021-44228)"
"Search for any components affected by CVE-2023-44487 (HTTP/2 Rapid Reset)"
"Find all occurrences of OpenSSL vulnerabilities in my SBOMs"

"Generate a security summary for [product] with all critical vulnerabilities"
"Create an executive summary of our vulnerability posture"
"List all components with known vulnerabilities grouped by severity"
"Summarize vulnerability trends between the last two versions"

"Compare the last two versions of [product] and highlight security changes"
"What new vulnerabilities were introduced in the latest version?"
"Show me components that were added or removed between versions"
"Has our security posture improved since the last release?"

"What policies are currently failing for [environment]?"
"Show me all versions that violate security policies"
"List all components using GPL licenses"
"Which products have deprecated licenses?"

"Find all instances of log4j across my organization"
"List all components from [vendor]"
"Show me direct vs transitive dependencies in [version]"
"Which components are missing PURL identifiers?"

brew install interlynk-io/tap/lynk-mcp

go install github.com/interlynk-io/lynk-mcp/cmd/lynk-mcp@latest

# Pull from GitHub Container Registry
docker pull ghcr.io/interlynk-io/lynk-mcp:latest

# Run with API token
docker run -e LYNK_API_TOKEN=lynk_live_xxx ghcr.io/interlynk-io/lynk-mcp serve

git clone https://github.com/interlynk-io/lynk-mcp.git
cd lynk-mcp
make build

lynk-mcp configure

This prompts for:

1. API Endpoint (defaults to https://api.interlynk.io/lynkapi)
2. API Token (your Lynk API key: lynk_live_*, lynk_staging_*, or lynk_test_*)

The token is stored securely in your system keychain.

lynk-mcp verify

Stored in ~/.lynk-mcp/config.yaml:

api:
  endpoint: "https://api.interlynk.io/lynkapi"
  timeout: 30s
logging:
  level: "info"

Add to your config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "lynk": {
      "command": "lynk-mcp",
      "args": ["serve"]
    }
  }
}

claude mcp add lynk -- lynk-mcp serve

Or add to ~/.claude/settings.json:

{
  "mcpServers": {
    "lynk": {
      "command": "lynk-mcp",
      "args": ["serve"]
    }
  }
}

Add to settings.json or .vscode/mcp.json:

{
  "mcp": {
    "servers": {
      "lynk": {
        "command": "lynk-mcp",
        "args": ["serve"]
      }
    }
  }
}

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "lynk": {
      "command": "lynk-mcp",
      "args": ["serve"]
    }
  }
}

Add to ~/.config/zed/settings.json:

{
  "context_servers": {
    "lynk": {
      "command": {
        "path": "lynk-mcp",
        "args": ["serve"]
      }
    }
  }
}

{
  "mcpServers": {
    "lynk": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "LYNK_API_TOKEN=lynk_live_xxx", "ghcr.io/interlynk-io/lynk-mcp", "serve"]
    }
  }
}

• API tokens stored in system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
• Tokens never logged or exposed
• All API communication uses HTTPS
• Organization scoping enforced by Lynk API

• Go 1.24 or later

make build          # Build for current platform
make build-all      # Build for all platforms
make test           # Run tests
make lint           # Run linter

lynk-mcp/
├── cmd/lynk-mcp/          # CLI entry point
├── internal/
│   ├── api/               # High-level API client
│   ├── config/            # Configuration and keyring
│   ├── graphql/           # GraphQL client and queries
│   └── mcp/               # MCP server implementation
├── Dockerfile             # Multi-platform container build
├── go.mod
├── Makefile
└── README.md

• sbomqs - SBOM quality scoring and compliance
• sbomasm - SBOM assembler, merger, and editor
• sbomex - Search and download public SBOMs
• sbomgr - Context-aware SBOM search

Apache License 2.0

• GitHub Issues
• Community Slack
• Email

Made with care by Interlynk.io

d