Vulnicheck
Scans Python dependencies and GitHub repositories for vulnerabilities by querying OSV.dev, NVD, GitHub Advisory, CIRCL, and Safety DB. Exposes nine tools including check_package_vulnerabilities, scan_dependencies, scan_dockerfile, and scan_github_repo for direct repository analysis up to 1GB. Also detects exposed secrets, validates MCP configurations, and provides AI-powered risk assessment when you pass an OpenAI or Anthropic key. Ships as a Docker container with HTTP streaming, no SSE required. Works immediately without API keys for basic scanning, though GitHub tokens and NVD keys improve rate limits. Includes smart caching at the commit level and automatic cleanup to prevent disk exhaustion.
- GitHub stars
- 11
- tools
- 10
- auth
- Secret needed
- transport
- HTTP
- env vars
- 7
- last updated
- Sep 19, 2025
Tools
10 toolsPublic tool metadata for what this MCP can expose to an agent.
check_package_vulnerabilitiesCheck a specific Python package for vulnerabilities.
Check a specific Python package for vulnerabilities.
No parameter schema in public metadata yet.
scan_dependenciesScan dependency files (requirements.txt, pyproject.toml, etc.).
Scan dependency files (requirements.txt, pyproject.toml, etc.).
No parameter schema in public metadata yet.
scan_installed_packagesScan currently installed Python packages.
Scan currently installed Python packages.
No parameter schema in public metadata yet.
get_cve_detailsGet detailed information about a specific CVE.
Get detailed information about a specific CVE.
No parameter schema in public metadata yet.
scan_for_secretsDetect exposed secrets and credentials in code.
Detect exposed secrets and credentials in code.
No parameter schema in public metadata yet.
scan_dockerfileAnalyze Dockerfiles for vulnerable Python dependencies.
Analyze Dockerfiles for vulnerable Python dependencies.
No parameter schema in public metadata yet.
scan_github_repoComprehensive security scan of GitHub repositories.
Comprehensive security scan of GitHub repositories.
No parameter schema in public metadata yet.
assess_operation_safetyAI-powered risk assessment for operations.
AI-powered risk assessment for operations.
No parameter schema in public metadata yet.
validate_mcp_securityValidate MCP server security configurations.
Validate MCP server security configurations.
No parameter schema in public metadata yet.
comprehensive_security_checkInteractive AI-powered security assessment.
Interactive AI-powered security assessment.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
NVD_API_KEYsecretAPI key for NIST National Vulnerability Database (increases rate limit from 5 to 50 requests per 30 seconds)
GITHUB_TOKENsecretGitHub token for Advisory Database access (increases rate limit to 5000 requests per hour)
OPENAI_API_KEYsecretOpenAI API key for LLM-based risk assessment in MCP passthrough operations
ANTHROPIC_API_KEYsecretAnthropic API key for LLM-based risk assessment (alternative to OpenAI)
MCP_PORTPort for MCP HTTP server (default: 3000)
CACHE_TTLCache time-to-live in seconds for vulnerability data (default: 900)
VULNICHECK_HTTP_ONLYEnable HTTP-only mode with MCP client delegation (true/false, default: auto-detect)
Readme
VulniCheck - AI-Powered Security Scanner
VulniCheck provides comprehensive security analysis for Python projects and GitHub repositories using AI-powered vulnerability detection. It runs as a Docker-based HTTP MCP server with standard HTTP streaming (no SSE required), providing secure containerized deployment with comprehensive vulnerability scanning capabilities.
Quick Start
1. Pull and Run the Docker Container
# Pull the latest image from Docker Hub
docker pull andrasfe/vulnicheck:latest
# Run with OpenAI API key (for enhanced AI-powered risk assessment)
docker run -d --name vulnicheck-mcp -p 3000:3000 \
--restart=unless-stopped \
-e OPENAI_API_KEY=your-openai-api-key \
andrasfe/vulnicheck:latest
# Or run without API key (basic vulnerability scanning)
docker run -d --name vulnicheck-mcp -p 3000:3000 \
--restart=unless-stopped \
andrasfe/vulnicheck:latest
2. Add to Claude Code
claude mcp add --transport http vulnicheck http://localhost:3000/mcp
That's it! VulniCheck is now available in Claude Code.
Usage
Once installed, simply ask Claude:
"Run a comprehensive security check on my project"
Details
- Repository
- github.com/andrasfe/vulnicheck
- Category
- Security & Pentesting
- Package
docker.io/andrasfe/vulnicheck:main- Transport
- HTTP
- Auth
- Required
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Operant Mcpoperantlabs/operant-mcpSecurity testing MCP server for penetration testing, forensics, and vulnerability assessment8stars
Snyk API & Web MCP Serversnyk/saw-mcpMCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage7stars
Ansvar: Threat Intelligenceansvar-systems/ansvar-gatewayCVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.0stars
OWASP ZAP MCP Serverpierre3/dotnet-zap-mcpMCP server for OWASP ZAP vulnerability scanning with Docker management3stars
Black Duck Security Scannerblackducksoftware/mcp-serverAI-powered security scanning using Black Duck Signal for vulnerability detection.0stars
Sectorabraineetech/sectoraThreat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.0stars