GhostFree
Scans your repository's dependency manifests (package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, and more) and checks them against OSV.dev's CVE database. Exposes six tools: discover_dependencies to find all pinned packages, check_cves to query for vulnerabilities with severity filtering, enrich_cve to pull CVSS scores and CISA KEV exploitation status from NVD, plus accept_risk and remove_accepted_risk to manage exceptions with expiry dates. Ships with a /ghostfree.scan prompt that walks through discovery, triage, and remediation in a conversational flow. Accepted risks live in .ghostfree/accepted.yml so your team can commit suppression decisions to version control. Runs locally via npx with no signup or API keys required.
- GitHub stars
- 1
- tools
- 6
- auth
- Secret needed
- transport
- STDIO
- env vars
- 3
- last updated
- Apr 7, 2026
Tools
6 toolsPublic tool metadata for what this MCP can expose to an agent.
discover_dependenciesScan repo manifests, return all pinned packages by ecosystem
Scan repo manifests, return all pinned packages by ecosystem
No parameter schema in public metadata yet.
check_cvesQuery OSV.dev for CVEs, filter by severity, apply accepted risks
Query OSV.dev for CVEs, filter by severity, apply accepted risks
No parameter schema in public metadata yet.
enrich_cveFetch CVSS, CWE, references from NVD + KEV exploitation status
Fetch CVSS, CWE, references from NVD + KEV exploitation status
No parameter schema in public metadata yet.
list_accepted_risksList all accepted risks with expiry status and severity snapshot
List all accepted risks with expiry status and severity snapshot
No parameter schema in public metadata yet.
accept_riskRecord an accepted risk with reason, expiry date, and severity snapshot
Record an accepted risk with reason, expiry date, and severity snapshot
No parameter schema in public metadata yet.
remove_accepted_riskRemove an accepted risk by UUID
Remove an accepted risk by UUID
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
GHOSTFREE_DIROverride the directory where GhostFree stores its data files (accepted-risks.yml, config.yml). Defaults to .ghostfree/ in the scanned repository root.
GHOSTFREE_MIN_SEVERITYdefault: MEDIUMMinimum CVE severity level to surface. One of: CRITICAL, HIGH, MEDIUM (default), LOW.
NVD_API_KEYsecretOptional NVD API key for higher rate limits when enriching CVE details. Free to request at https://nvd.nist.gov/developers/request-an-api-key.
Readme
What is GhostFree 🚫👻?
Every software team could use some help ridding their code base of the ghosts haunting their dependencies.
GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.
Quick Start
No installation, signup, or payment required. Add GhostFree to your MCP settings for whatever code tool you use and run /ghostfree.scan.
VS Code Copilot (Extension — easiest)
Search @mcp ghostfree in the Extensions view (Ctrl+Shift+X) and click Install. Then open the Command Palette (Ctrl+Shift+P), run MCP: List Servers, select GhostFree, choose Start Server, and confirm trust when prompted. No JSON config needed.
VS Code Copilot (Manual config)
Create or update .vscode/mcp.json in your project root:
Details
- Repository
- github.com/shane-js/ghostfree
- Website
- github.com/shane-js/ghostfree#readme
- Category
- Security & Pentesting
- Package
ghostfree- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Securityscorecard Mcpcallmarcus/security-scorecard-mcpCommunity-built, comprehensive MCP server for the SecurityScorecard API (unofficial).0stars
Obsidian Mcp Securedewtech-technologies/obsidian-mcp-secureSecure MCP server for Obsidian with OWASP Top 10 controls and full audit logging.0starsTubemind Secure Mcpdewtech-technologies/tubemind-secure-mcpSecure MCP server for YouTube intelligence — 18 tools, OAuth2, OWASP Top 10 controls.0stars
Dep Oracleertugrulakben/dep-oraclePredictive dependency security engine. Trust scores, zombie detection, blast radius analysis.0stars
Dlp Mcpcx-anand-nandeshwar/security-mcp-marketplaceThe DLP MCP provides the compliance violation in the one drive, google drive documents.0stars