# flagrix [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/flagrix-io/flagrix-cli  
**GitHub Stars:** 2  
**npm Downloads (last month):** 489  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/flagrix

## Description
Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "flagrix": {
    "command": "npx",
    "args": ["-y","flagrix"]
  }
}
```

## Documentation

## What flagrix MCP server does

flagrix scans GitHub repositories before they are cloned and evaluates GitHub profiles for scam-related signals. Its MCP interface provides two agent tools: `scan_github_repo` and `scan_github_user`. Repository results include a risk verdict, security score, scanned-file and dependency counts, detected issues, and the commit SHA used for the assessment.

The repository scanner is intended for situations where source code may be hostile, including fake recruiting assignments and unfamiliar public projects. It can identify patterns associated with data exfiltration and other malicious behavior, and it checks dependencies against a curated malicious-package feed.

Verdicts are risk assessments rather than definitive fraud determinations. They should be verified through official channels before a high-impact decision.

## How it works

The scanner reads repository files at a specific commit. A branch or other ref resolves to a commit, and the resulting verdict records that commit SHA. This prevents a repository push during or after a scan from silently changing the code represented by the result.

Scanning logic comes from `@flagrix/scanner-core`, with signatures maintained in the `flagrix-detection-rules` repository. Detection rules are refreshed and cached for six hours, and a bundled snapshot allows scanning to continue offline with the included rules.

Dependency names are matched locally against `osv-malicious.json`, a feed of npm and PyPI packages confirmed malicious by the OpenSSF malicious-packages project. The feed is also cached for six hours and revalidated with its ETag. Network requests go to GitHub and npm APIs, plus the public detection-rules repository; the tool does not send dependency names to a Flagrix backend.

## Setup and configuration

Run the MCP process through `npx`:

```bash
claude mcp add flagrix -- npx -y flagrix mcp
```

The MCP command uses stdio, so it can be registered with an MCP-compatible client that launches local processes. The command-line package also offers direct scanning with `flagrix scan <url | owner/repo>` and profile scoring with `flagrix scan-user <username>`.

Unauthenticated GitHub access is limited to 60 requests per hour. A repository scan may use one request per file, up to approximately 50 requests. Set `GITHUB_TOKEN` or `FLAGRIX_GITHUB_TOKEN` to raise the GitHub limit to 5,000 requests per hour and enable private-repository scans. A token can also be supplied with the CLI's `--token` option.

Set `FLAGRIX_OSV_FEED=0` to disable the OSV malicious-package feed. The curated signatures remain active when this feed is disabled.

## Tools and capabilities

- `scan_github_repo`: scan a GitHub repository for malicious code, dependency risks, and related issues.
- `scan_github_user`: score a GitHub profile for scam signals.
- Commit-pinned repository results with the scanned `commitSha`.
- Local matching against the cached OSV malicious-package feed.
- Access to private repositories when a suitable GitHub token is configured.
- A Claude Code hook is included for gating `git clone` operations on a scan.

The CLI supports `--json`; JSON output is selected automatically when standard output is piped. Exit codes distinguish low risk, scan failure, medium risk requiring review, and high risk where cloning should be avoided.

## Limitations and notes

Unauthenticated scans consume GitHub's shared request budget, so large repositories or repeated scans can encounter rate limits. Detection results depend on the available signatures and malicious-package data, including the six-hour refresh and the bundled offline snapshot.

A risk verdict is not proof of fraud or safety. Review findings and confirm the repository or profile through trusted, official channels before proceeding. The project is licensed under MIT, as are the scanner-core and detection-rules components referenced by the project.

_Full upstream README: https://allmcps.com/mcp/flagrix/readme_