Prototype · Preview: every server in the official registry, synced every 30 minutes. Reviews and accounts come in a later step.
PopNx MCPMCP servers for people who use AI · explained in plain words

Lattice: CVE, MITRE ATT&CK and detection graph for security agents

by namiq.ioversion 0.2.3i★ –iRuns in the cloud
Registry nameio.namiq/lattice

Install

Overview

Description from the maker (original English)

CVE, KEV, MITRE ATT&CK, CWE and detection graph for AI agents; every link names its source.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

  • Connection: Runs in the cloud
  • Transport: Streamable HTTP
  • Category: Other
  • You need to fill in: X-API-Key

Install

Pick the AI app you use, then copy the settings.

Before you install

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Which app do you use?

Pick your app above. We remember it, so next time the button says “Install in …”.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Run this in your terminal

claude mcp add --transport http lattice https://lattice.namiq.io/mcp --header 'X-API-Key: your-value'

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "lattice": {
      "url": "https://lattice.namiq.io/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "lattice": {
      "type": "http",
      "url": "https://lattice.namiq.io/mcp",
      "headers": {
        "X-API-Key": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

  • X-API-Key secret required HTTP header
    Key. A person requests one at https://namiq.io/lattice; an AI agent can POST https://namiq.io/api/v1/lattice/agent-keys. Shown once, and emailed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

  • graph_meta

    Describe the graph this server reads, without looking up any fact in it. Returns the snapshot id and creation time, the schema version with notable schema changes, the node labels (types), the relationship verbs, the contributing sources, and the path templates that graph_path ac

  • graph_lookup

    Start here when a CVE, ATT&CK technique or CWE id appears in your task. Find nodes by exact external id, e.g. CVE-2021-44228, T1059.001, CWE-79. Returns each match with its source (a CVE has a kev node if CISA lists it as exploited, and an nvd node) and a uid for graph_node and g

  • graph_search

    List nodes whose external id starts with a prefix (e.g. CVE-2024-1, T105). Ids only, not free text. If the answer has truncated: true, pass its next_cursor as cursor to continue; a list without truncated is complete.

  • graph_node

    One node's properties (long text is clipped). uid comes from graph_lookup or graph_search. On a kev node: date_added, due_date, known_ransomware_use (Known or Unknown; Unknown means not recorded), required_action, vendor_project, product. On an nvd node: description and metadata

  • graph_neighbors

    Directly connected nodes with each link's verb, source, confidence and whether it is declared or inferred. Declared and cross-source links come first. If the answer has truncated: true, pass its next_cursor as cursor to continue.

  • graph_path

    Answer a multi-hop question from an external id in one call instead of several lookups: for a CVE, the attack techniques it enables and the detections and response procedures for them. Needs a key; without one the error says how to get one. Templates: cve-context (start: CVE), cv

  • graph_notices

    Return the licence and attribution notices for the data sources behind an answer. Other tools list notice ids with their answers. Pass those ids here to get, for each notice, its title, what it applies to, the obligation it places on you (for example attribution wording or a shar

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

  • ! Caution

    Maker matches the repo

    The registry lists no source repo, so we cannot match the publisher (namiq.io) to the code

  • … Not checked yet

    Still maintained

    We have not read this repo from GitHub yet

  • … Not checked yet

    Has a licence

    We have not read this repo from GitHub yet

  • ✓ Pass

    Endpoint responds

    Responded in 528 ms (HTTP 200)

  • – Not applicable

    Sign-in with OAuth

    No sign-in needed

  • ✓ Pass

    No hidden instructions in tool descriptions

    Read 7 tool descriptions and found no hidden instructions to the AI

Compared with others in Otheri

  • More stars than 0% of the other 32691 servers in this category
  • Published to the registry more recently than 87% of the other 32691 servers in this category
  • Basic checks equal to or better than 37% of the other 32691 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Lattice: CVE, MITRE ATT&CK and detection graph for security agents safe?

It passed 2 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: X-API-Key

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.2.3) reached the registry 5 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Dialyne

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago
Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago
Install

Dialyne

by dialyne

Real phone calls in France for AI agents: dial +33 numbers, menus, hold, AI disclosure.

Runs in the cloudUpdated today
Install

README from the maker

No README found in the repo

Ask PopNx