part of bumper · guardrails for your infrastructure

A security brain your agent can query.

bumper Advisor is a free, public, knowledge-only API for developers and AI coding agents — over MCP and REST. It never sees your code or infra. It answers two questions: what's the best practice, and am I affected.

2,700+IaC rules & advisories

178k+CVEs mirrored

226k+malicious packages

3.4Maffected versions

▹ free & public · no account▹ OSV-backed · refreshed daily▹ knowledge-only · never sees your code

live playground

Ask it anything. Right here.

Wired to the live API at advisor.bumper.sh. Falls back to example data if the network's down, so the demo always works.

best-practice catalog

try

Search the knowledge base

Pick a mode, type a query, or tap an example. bumper Advisor never sees your code — it only returns knowledge.

model context protocol

Give your agent this knowledge.

Connect bumper Advisor over MCP and your coding agent can check a CVE or an IaC rule mid-task — before it writes the Terraform, not after the incident.

1 · add the server

$claude mcp add --transport http bumper-advisor https://advisor.bumper.sh/mcp

2 · or drop in the config

{
  "mcpServers": {
    "bumper-advisor": {
      "url": "https://advisor.bumper.sh/mcp"
    }
  }
}

one HTTP endpoint · /mcp · no key, no account

Six tools your agent gains

Knowledge-only. The agent queries; bumper never receives your code or infra.

search_rulesSemantic + lexical search over the federated IaC best-practice catalog (Trivy, Checkov, KICS, Prowler + bumper's enforced rules).

get_ruleFetch the full rule record by id — rationale, severity, remediation, and source provenance.

search_cveSemantic CVE search across 78k semantically-indexed advisories when you only have a description, not an id.

lookup_cveExact package@version → CVEs. The “am I affected?” question, answered deterministically.

get_vulnFetch the full CVE / GHSA record — affected ranges, fixed versions, CWE, aliases.

check_malwareIs a package known-malicious (typosquat, backdoor, install-time payload)? The safety check to run before you add a dependency — name-level, no version needed.

in practice

The agent checks before it ships.

claude-code · bumper-advisor connected

agent

The lockfile pins django 3.2.0. Let me check it against the advisory database before I touch the deploy.

tool

lookup_cve(ecosystem="PyPI", package="django", version="3.2.0") → 1 critical, 2 high · CVE-2022-28346 · fixed_version "3.2.13"

agent

Heads up — django 3.2.0is affected by CVE-2022-28346, a critical SQL injection (CWE-89). I'd bump to 3.2.13 or later before deploying. Want me to update requirements.txt and re-run the tests?