# Husk [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/husk-security/husk  
**GitHub Stars:** 6  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/husk

## Description
Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/husk-security/husk), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
curl -fsSL https://husk-security.dev/install.sh | sh
```

## Documentation

## What Husk MCP server does

The Husk MCP server brings Husk’s local security checks into an MCP-based agent workflow. Husk is a command-line security scanner for developer machines and project directories, focused on compromised or vulnerable packages, exposed secrets, risky install scripts, and unsafe AI or MCP settings.

Its underlying scanner can inspect a directory, check an individual package, produce a findings report, gate CI builds, and apply selected fixes. Project policies stored in `.husk/policy.toml` can define package decisions, suppressed findings, and CI thresholds. Trust decisions can also be recorded in Husk’s personal ledger.

## How it works

Husk runs as a local binary. The CLI entry point for the MCP interface is `husk mcp`, which can run the MCP server or register it with an AI agent.

The scanner itself keeps its state locally. Reports, scan indexes, ledger data, daemon state, and credentials use local directories by default. Normal online advisory lookups send package names, versions, and CVE identifiers to public sources including OSV.dev, npm, PyPI, GitHub, CISA KEV, and FIRST EPSS. Passing `--offline` disables network calls.

## Setup and configuration

Husk supports Linux and macOS. Windows users must run it through WSL; there is no native Windows build. The documented installer places the binary in `~/.local/bin`, and the installation directory can be changed with `HUSK_INSTALL_DIR` or `--install-dir`. Cargo, cargo-binstall, npm, and Nix are also supported installation paths.

Run `husk mcp` to start or register the MCP interface.

Useful configuration variables include `HUSK_HOME` for state, `HUSK_CACHE_DIR` for cached reports and indexes, `HUSK_PAGER` or `PAGER` for long CLI output, `NO_COLOR` to disable ANSI colors, and `HUSK_TOKEN` for cloud-command bearer-token overrides. None is documented as mandatory for the local scanner or MCP command.

## Tools and capabilities

The Husk MCP server is backed by commands that can:

- Scan a directory and print or export a findings report.
- Check a package version against malware and vulnerability advisories.
- Read the latest scan without rescanning.
- Gate a build with a severity threshold and JSON output.
- Plan fixes, with `--apply` writing auto-safe changes and backups.
- Create and inspect project policy, approve packages, or suppress findings.
- Open the latest report in a terminal UI or local web UI.
- Run periodic scans through the daemon command.

JSON reports are emitted by scan, status, TUI, and CI workflows. The report format includes an API version and is stored in the local cache for the interfaces to render.

## Limitations and notes

Husk is pre-1.0 software and has not had an independent audit; interfaces may change between releases. Treat those as implementation details requiring repository or release-specific verification.

Local scanning does not mean every operation is offline. Advisory lookups use external public databases unless offline mode is selected.

_Full upstream README: https://allmcps.com/mcp/husk/readme_