Supply-Chain Audit

Intro

Use /pk-supply-chain when you need a release-facing supply-chain view. The MCP server exposes three tools:

• discover_manifests
• run_supply_chain_audit
• export_supply_chain_sbom

Network-dependent security and quality probes are intentionally off by default. Enable them only when explicitly requested.

Overview

1. Discover dependency manifests and supported lockfiles.
2. Run run_supply_chain_audit with explicit run_security_checks / run_quality_checks when required.
3. Export SBOM when release evidence is needed.

Gotchas

• Offline default. Missing network adapters must be explicit, not implicit.
• Discover-only checks are not guarantees. Discovery does not confirm policy.
• Export output. Persist SBOM/report output only when write_output=True.

Full reference

discover_manifests

• project_root: str | None = None
• manifest_globs: list[str] | None = None
• include_vendor_dir: bool = True
• include_ci_manifests: bool = False

run_supply_chain_audit

• project_root: str | None = None
• manifest_paths: list[str] | None = None
• run_security_checks: bool = False
• run_quality_checks: bool = False
• network_enabled: bool = False
• write_output: bool = False
• output_path: str | None = None

export_supply_chain_sbom

• project_root: str | None = None
• manifest_paths: list[str] | None = None
• format: str = "json"
• write_output: bool = False
• output_path: str | None = None