Your agent tells you what to patch

Claude Desktop, VS Code and Windsurf, plus config-file setups for Claude Code, Cursor and Codex. Each finishes with the same sign-in.

claude mcp add --scope local --transport http patchnext https://mcp.patchnext.com
claude mcp login patchnext

Manage agent access or create a fallback token

Transport

Streamable HTTP. Works with current and older MCP clients.

Authentication

OAuth 2.1 for clients that support MCP authorization: the client finds Patch Next’s authorization server from the endpoint, registers itself and opens the consent page. Google sign-in only identifies you on this site; it never authorizes an agent.

Personal agent token otherwise, sent only as Authorization: Bearer pnat_…. Never put it in a URL, a feed or a log.

Permissions

stacks:read on the stacks you select. An agent cannot change agent tokens or consent, cannot widen its own access, and the database refuses its credentials for private data. It can mark findings only after you allow that agent on your agents page.

Saving machine inventory is off by default. For OAuth, allow it on the consent page or in Agent access. For a personal token, enable it on Agent permissions. Each consented check keeps only package name, ecosystem, version, lockfile path, machine and timestamp, never file contents or source code. Legacy inventory replacement with update_stack still requires explicit consent for each update.

Expiry and revocation

OAuth access lasts until you revoke it; the app renews its one-hour sign-in. Tokens expire within 90 days, and Patch Next stores only their SHA-256 digest and shows them once. Either way, revoking takes effect on the next request.

• list_stacksread-only

  Saved stacks you are authorized to read: ids, revisions, inventory age, last recorded agent check and current coverage.

• get_stack_updatesread-only

  Without a cursor: a bounded current baseline of findings for the saved stack. With a checkpoint cursor: material changes since it (new advisories, corrections, range or fix changes, exploitation confirmations, withdrawals). At most 50 results per page; follow next_cursor while has_more is true and persist it only when checkpoint is true. Pass your hostname as machine. Open only by default; include_handled:true reveals handled items and hidden_count counts them. since is an alias for cursor. After applying a patch, call mark_findings. compact:true uses short fields; verbose:true preserves the original response. Cursors work in either mode.

• get_advisoryread-only

  Full source-backed record for one published advisory by any upstream alias or Patch Next slug, with an optional match against an authorized stack.

• explain_matchread-only

  Identity, version and context reasoning for one advisory against an authorized stack, including the facts Patch Next is missing.

• check_componentsread-only

  Bounded transient assessment of a current local inventory (up to 5000 supported package components). Never saved and never moves a saved-stack checkpoint. Follow next_cursor with identical components/context while has_more; verbose:true returns full fields.

• what_to_patchread-only

  Pass your hostname as machine. Open findings only by default, with hidden_count; include_handled:true reveals the rest. Save next_since for only new material changes next time. After applying a patch call mark_findings (ids or all_returned with selection). scope:all_machines returns the fleet. Quick patch queue for an authorized stack: a paginated list of actionable items published in the last 90 days OR still unpatched in supported installed versions. Ranked CISA KEV first, then dated EPSS descending, then severity. Use limit/offset and only_affected; get_stack_updates provides complete history.

• get_actionable_updatesread-only

  Concise source-backed actions for one authorized stack. Default: published in 90 days OR supported installed versions still affected. Use offset only while the inventory stays unchanged.

• get_inventory_findingsread-only

  Match reported products/runtimes/OSs and SaaS vendors against real NVD CPE configurations and CISA KEV. Pass hostname to filter; scope mine uses assigned owners. Open findings by default; include_handled reveals assertions. Follow next_cursor while has_more, then keep next_since for source changes. Empty pages can still have more candidates. Unknown identities/platforms/versions remain uncertain; a vendor CVE is not proof your SaaS is exposed. Mark exact returned subject_id+nvd_cve_id targets with mark_findings after assessment/patching; vendor statuses are asked_vendor/vendor_confirmed_patched/not_affected with an optional statement URL.

• get_patch_reportread-only

  Export authorized status history, actor ids, detection times, before/after workflow and vendor statements. scope mine uses current assigned owners. Cursor pages split even a large bulk action without exposing global action sequence numbers. Time to patch needs a previously recorded open detection; first marking patched yields no invented zero interval. Default excerpts disclose truncation; verbose:true returns full snapshots and can exceed the normal concise response bound. This is evidence, not certification or independent verification.

• update_stackwrites, opt-in per token

  To report products/vendors, send products[] with an existing target_stack/stack_id, inventory_observed_at, consent and consent_statement, in a separate call from components[]. Names resolve only through verified NVD identities; supply vendor/product or cpe23 when known. Product updates require personal stacks:write plus triage opt-in. Pass machine (your hostname) to report only that machine: requires owner-enabled inventory-write consent (personal token or OAuth); automatic observed-version reconciliation also requires triage-write consent. Legacy stack replacement retains explicit per-call consent. Omit machine for the existing stack replacement, requiring owner-enabled stacks:write personal-token scope and explicit per-call consent. Replaces the selected inventory atomically; pass expected_revision. OAuth inventory consent supports machine snapshots; legacy stack replacement requires a personal token. Read-only credentials cannot save inventory. Select organization by id/name (default: your single organization, otherwise Personal). Without target_stack, upserts by source_repo, then stack_name; new stacks are granted only to this token.

• declare_stackwrites, opt-in per token

  Create a stack by declaring its inventory, or replace a selected inventory with target_stack and expected_revision. Select organization by id/name (default: your single organization, otherwise Personal) and source_repo from the current repository. Uses the same handler, owner-enabled stacks:write scope and explicit consent as update_stack.

• get_coverageread-only

  Source coverage and freshness. Lists only sources that have run; stale sources remain visible. No match is not an all-clear.

• mark_findingswrites, opt-in per token

  After applying a patch, mark findings patched for your hostname. For products/vendors pass explicit targets:[{subject_id,nvd_cve_id}] from get_inventory_findings; vendor statuses asked_vendor/vendor_confirmed_patched/not_affected can carry evidence_url. Signed all_returned selections apply to package queues only. This is an agent assertion, not independent verification. Requires owner-enabled triage writes. ids accepts CVEs/GHSAs/slugs/UUIDs, or all_returned with the signed selection returned by the read. status open reopens. command start_fresh opens all for this machine; baseline hides older revisions; copy copies from copy_from; undo reverses action_id or your last action. All status changes retain history. scope stack supports only not_affected and includes future machines.

Results never resolve or acknowledge a finding and carry no advertising. Coverage is partial; degraded coverage is reported, never an all-clear. Schemas and example responses: MCP tool reference.

Connecting MCP does not start background work; your agent host runs the task, so the browser can stay closed. Patch Next shows “monitoring observed” only after a successful update check in the last 36 hours.

Use Patch Next at https://mcp.patchnext.com. Once each day, inspect my current resolved dependencies. If they differ from Patch Next's saved inventory, report the stale saved stack and use check_components for a fresh transient assessment. Also read my configured saved-stack updates using the checkpoint bound to that stack revision. Inspect all returned pages and save the new checkpoint only after successful processing. Alert me to relevant new findings, material changes, missing context and degraded coverage. Verify recommendations against primary sources and my current inventory. Propose a patch plan and relevant regression checks. Do not deploy changes or rotate secrets without my authorization.

• Signed-out visitors get the public get_advisory tool only. The stack tools appear after you sign in and disappear when you sign out.
• Tools run in this tab with your own access and exist only while a Patch Next tab is open. WebMCP is not the remote endpoint and does not schedule anything.
• Works in browsers with WebMCP, such as Chrome 149 or later (in Chrome, turn on chrome://flags/#enable-webmcp-testing).