# GhostFree [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/shane-js/ghostfree  
**GitHub Stars:** 1  
**npm Downloads (last month):** 106  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/ghostfree

## Description
MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

## Tools
Capabilities this server exposes over MCP:

- **discover_dependencies** — Scan the repository for manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, Dockerfiles, etc.) and return all pinned dependencies grouped by ecosystem.
- **check_cves** — Check a list of packages against OSV.dev for known vulnerabilities. Returns CVEs above the severity threshold as a numbered list, suppressed/accepted risks, expired acceptances, and a count of below-threshold findings.
- **enrich_cve** — Fetch enrichment data for a specific CVE ID: CVSS vectors and score from NVD, CWE weakness classification, references, and whether it appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. Gracefully degrades if NVD or KEV are unavailable.
- **list_accepted_risks** — List all accepted CVE risks, including whether each acceptance has expired.
- **accept_risk** — Record an accepted risk for a CVE, with a reason and mandatory expiry date. Expiry beyond 1 year requires confirm_extended_expiry=true.
- **remove_accepted_risk** — Remove a previously accepted risk by its UUID acceptance ID.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "ghostfree": {
    "command": "npx",
    "args": ["-y","ghostfree"]
  }
}
```

## Documentation

## What GhostFree MCP server does

The GhostFree MCP server examines dependency manifests in a repository and turns the discovered package versions into vulnerability findings. It supports manifests such as `package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `pom.xml`, and `.csproj` files. Results are grouped by ecosystem and can be limited to a minimum severity of CRITICAL, HIGH, MEDIUM, or LOW.

GhostFree uses OSV.dev for the initial CVE lookup. For findings selected for investigation, it can retrieve CVSS details, CWE classifications, reference links, and CISA Known Exploited Vulnerabilities status through NVD and KEV data. This makes it useful for separating urgent findings from issues that need additional context.

## How it works

The recommended workflow starts with `/ghostfree.scan` in the connected coding assistant. GhostFree first discovers manifests and packages, then determines the severity threshold. It queries OSV.dev, presents findings in numbered groups of up to 10, and lets you choose which entries to inspect further.

An enriched result can include the affected package and version, CVSS information, CWE data, references, exploitation status, and a suggested remediation. Recommendations may include upgrading a direct or transitive dependency, applying a code change, or documenting the issue as an accepted risk. The example workflow also considers whether a dependency is directly imported and whether it appears reachable from application code.

Accepted risks are stored in `.ghostfree/accepted.yml`. Each record includes a CVE, business reason, expiration date, and severity snapshot. Future scans suppress the CVE until its acceptance expires. The file can be committed so the decision is available to other contributors.

## Setup and configuration

GhostFree runs locally through an MCP stdio configuration and can be launched with `npx -y ghostfree --repo-path <path>`. The repository path may be the current directory or a workspace path. VS Code users can also install the GhostFree extension and start it from the MCP server list.

Create `.ghostfree/config.yml` in the repository root to set a shared scan threshold:

```yaml
min_severity: HIGH
```

The configuration file takes precedence over `GHOSTFREE_MIN_SEVERITY`. If neither is present, the scan asks for a threshold. `GHOSTFREE_DIR` changes the directory used for GhostFree state, including `accepted.yml` and `config.yml`. `NVD_API_KEY` is optional and raises the documented NVD rate limit from 5 to 50 requests per 30 seconds.

## Tools and capabilities

The GhostFree MCP server exposes six tools:

- `discover_dependencies` scans manifests and returns pinned packages by ecosystem.
- `check_cves` queries OSV.dev, applies the severity filter, and accounts for accepted risks.
- `enrich_cve` obtains NVD CVSS, CWE, references, and CISA KEV status.
- `list_accepted_risks` shows accepted entries, expiration status, and severity snapshots.
- `accept_risk` records a CVE decision with a reason, expiry date, and severity snapshot.
- `remove_accepted_risk` deletes an accepted-risk record using its UUID.

The first four tools are read-only. Accepting or removing a risk changes repository state and requires client confirmation.

## Limitations and notes

Accepted-risk severity and CVSS values are snapshots taken when the risk is recorded, rather than live values. Extended expirations may require an explicit confirmation, and accepted-risk records should be reviewed as their expiry dates approach.

_Full upstream README: https://allmcps.com/mcp/ghostfree/readme_