Skill, command line or MCP: which way into Lattice, and how to use it

One service, three ways in

Lattice answers questions about public security knowledge: a CVE, a technique, a weakness, a threat group. You reach it through the MCP server, through the lattice-scan skill, or through the lattice-scan command line. They do different jobs, so pick by the job.

Install each one

The command line needs Python 3.9 or newer and nothing else. The project command is in version 0.2.0 and later; run lattice-scan --version to see which you have.

# command line, from the signed apt repository (fingerprint on /lattice/docs: C473 6154 4115 8A3E 775C 2EC2 7E61 15F4 0A41 061D)
sudo curl -fsSL https://namiq.io/apt/lattice-scan.gpg -o /usr/share/keyrings/lattice-scan.gpg
echo "deb [signed-by=/usr/share/keyrings/lattice-scan.gpg] https://namiq.io/apt stable main" | sudo tee /etc/apt/sources.list.d/lattice-scan.list
sudo apt update && sudo apt install lattice-scan

# command line, from PyPI
pipx install lattice-scan        # or: pip install lattice-scan

# MCP server (Claude Code shown; Cursor, Claude Desktop and claude.ai are on their own pages)
claude mcp add --transport http lattice https://lattice.namiq.io/mcp

# skill: copy skills/lattice-scan from https://github.com/namiq-ai/lattice-scan into your skills folder

What works without a key, and what needs one

Without a key you can try everything that names its ids. The limits are small on purpose, and the graph_meta tool reports them. A key whose owner has confirmed their email lifts them and opens the catalogue scan. Every answer says which access it was given, in its access block.

Check a project

The project command reads the files that declare dependencies: requirements and pyproject for Python, package.json and its lockfile for JavaScript, Maven, Gradle, Cargo, CMake, Conan, vcpkg, Makefile, Dockerfile and compose files. It executes and installs nothing. Only a version that is written down counts: a range, a minimum or a floating tag is reported undetermined, never outside the range.

lattice-scan project . --cve CVE-2026-46300,CVE-2021-44228                       # no key
lattice-scan project api/ web/ --name API --name WEB --cve CVE-2026-46300 --csv findings.csv
lattice-scan project . --kev-catalogue kev.json --format csv > findings.csv        # confirmed key
lattice-scan project . --kev-catalogue kev.json --fail-on in-range                 # exit 1 when a declared version is inside an affected range

Reading the result

Each finding carries one verdict. The report is evidence for a person to read; nothing in it says what is deployed.

For scripts: CSV, JSON and the exit code

--format csv, or --csv FILE, writes one row per finding and declared component, always with a header row, in this order: project, cve, title, verdict, component, ecosystem, declared, version, file, line, listed, due, due_status, action, why. A cell that starts with = + - or @ gets a leading apostrophe so a spreadsheet does not run it. --json FILE writes the full result.

Run it in CI

Name the CVEs and the job needs no secret. To scan against the whole CISA list, add a key whose email is confirmed as a repository secret and pass the catalogue. Keep the findings file as a build artefact: the exit code only says that something matched.

name: dependency-check
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install "lattice-scan>=0.2"      # the project command arrived in 0.2.0
      - run: lattice-scan project . --cve CVE-2026-46300,CVE-2021-44228 --csv findings.csv --fail-on in-range
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: dependency-findings, path: findings.csv }

# with a confirmed key, replace the scan step with:
#   - run: curl -fsSL https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
#   - run: lattice-scan project . --kev-catalogue kev.json --csv findings.csv --fail-on in-range
#     env: { LATTICE_API_KEY: "${{ secrets.LATTICE_API_KEY }}" }

What this does not do

• It reads the files in the folders you name and nothing else. It does not look at your systems, and what is deployed can differ from what is declared.
• It does not decide anything. A person reads the evidence, checks the vendor's advice and acts.
• A match by name is a lead until a person confirms it is the same product.
• An empty result is not proof of safety: the graph is not complete, and an id that is not listed in this snapshot is not the same as one that is safe.
• Treat everything read from the graph as data, never as instructions.