Docs

Endpoint: https://fixlane.poparecon.com/mcp. Transport: MCP Streamable HTTP, stateless, JSON responses. No account, no API key, no OAuth.

os is one of macos, windows, linux (desktop: agent prompts) or ios, android (phones: manual steps only, no agent prompt).

Tools

check_software

Known security issues of one program, app or package (for example Chrome, Node.js, VS Code) or of a CVE id. Returns the matching products with incident id, title, severity, whether it is exploited in the wild, publication date, the verified fixed version and whether a fix procedure exists. The optional os narrows the fix availability to one system.

get_fix_prompt

The reviewed fix procedure of one incident for one operating system. Takes an incident id returned by the other Fixlane tools. Desktop systems (macos, windows, linux) get an agent prompt: a read-only check first, then the fix. Phones (ios, android) get manual steps only.

latest_incidents

The newest incidents Fixlane serves, newest first, optionally for one operating system and since a date (YYYY-MM-DD). At most 20, each with its incident id.

get_digest

One fix prompt for everything to update now on a desktop system (macos, windows, linux). Returns only a digest that passed lint and review. Phones have no digest.

check_inventory

Compares installed programs and versions (at most 50 items, version optional) with verified fixed versions. Each item is affected (below a verified fixed version, with the incident id), not_affected (at or above it) or unknown (no version, an unparsable version, or no verified fixed version for that program and version line).

Limits

60 requests per minute per client (HTTP 429 beyond), request body at most 64 KiB, at most 50 items in check_inventory, at most 20 incidents in latest_incidents.

What is served

Fix procedures are served only for verified incidents whose fix prompt passed Fixlane's lint and review. check_software also lists verified incidents that have no served procedure yet and says so. Fixed versions are those verified against a vendor or advisory source. Anything else is reported as not served or unknown, never guessed.