# vulnicheck [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/andrasfe/vulnicheck  
**GitHub Stars:** 11  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/vulnicheck

## Description
HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.

## Tools
Capabilities this server exposes over MCP:

- **check_package_vulnerabilities** — Check a specific Python package for vulnerabilities
- **scan_dependencies** — Scan dependency files (requirements.txt, pyproject.toml, etc.)
- **scan_installed_packages** — Scan currently installed Python packages
- **get_cve_details** — Get detailed information about a specific CVE
- **scan_for_secrets** — Detect exposed secrets and credentials in code
- **scan_dockerfile** — Analyze Dockerfiles for vulnerable Python dependencies
- **scan_github_repo** — Comprehensive security scan of GitHub repositories
- **assess_operation_safety** — AI-powered risk assessment for operations
- **validate_mcp_security** — Validate MCP server security configurations
- **comprehensive_security_check** — Interactive AI-powered security assessment

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/andrasfe/vulnicheck), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
docker pull andrasfe/vulnicheck:latest
```

2. Start the server:

```sh
docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  -e OPENAI_API_KEY=your-openai-api-key \
  andrasfe/vulnicheck:latest
```

3. Start the server:

```sh
docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  andrasfe/vulnicheck:latest
```

4. Add to Claude Code:

```sh
claude mcp add --transport http vulnicheck http://localhost:3000/mcp
```

5. Start the server:

```sh
docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  -e OPENAI_API_KEY=your-key \           # AI-powered risk assessment
```

6. Start the server:

```sh
docker run -d --name vulnicheck-mcp -p 3000:3000 \
     --restart=unless-stopped \
     -e FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID=your-client-id \
     -e FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET=your-secret \
     -e FASTMCP_SERVER_BASE_URL=http://localhost:3000 \
     -v vulnicheck_tokens:/home/vulnicheck/.vulnicheck/tokens \
     andrasfe/vulnicheck:latest \
     python -m vulnicheck.server --auth-mode google
```

## Documentation

## What vulnicheck MCP server does

The vulnicheck MCP server gives an MCP client access to security checks for Python projects and GitHub repositories. It can inspect dependency declarations such as `requirements.txt`, `pyproject.toml`, and `setup.py`, review packages installed in an environment, and look up information for a supplied CVE.

Code-oriented checks include exposed secrets and credentials, while Dockerfile analysis focuses on vulnerable Python dependencies. Repository scanning accepts public or private GitHub repositories and supports repositories up to 1 GB, according to the project documentation. The server also includes checks for MCP security configurations and interactive security assessments.

Its vulnerability coverage queries multiple sources, including OSV.dev, NVD, GitHub Advisory, CIRCL, and Safety DB. Scan results may include remediation recommendations. Commit-level caching is used to avoid repeating identical repository scans, and automatic cleanup limits stored data to 2 GB.

## How it works

The vulnicheck MCP server runs as a Docker container and exposes a streamable HTTP MCP endpoint. The documented local endpoint is `http://localhost:3000/mcp`; the container listens on port 3000. HTTP streaming is used without Server-Sent Events.

A client sends tool requests through MCP rather than invoking a command-line scanner directly. Available operations include package checks, dependency and installed-package scans, CVE lookups, secret detection, Dockerfile analysis, GitHub repository scans, operation safety assessment, MCP configuration validation, and a broader interactive security check.

The container can run without API keys for basic vulnerability scanning. OpenAI or Anthropic credentials enable the documented AI-assisted assessment features. A GitHub token can provide higher GitHub API rate limits, and an NVD key can provide higher NVD limits.

## Setup and configuration

The quickest setup is to pull `andrasfe/vulnicheck:latest` from Docker Hub and publish container port 3000. Claude Code can then register the endpoint with its HTTP transport and the `/mcp` path. The repository also documents building a local image from source with Docker.

No environment variable is required for the basic container startup. Optional variables include `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GITHUB_TOKEN`, and `NVD_API_KEY`.

Google OAuth 2.0 configuration is documented, but it is disabled by default and currently does not work correctly with the HTTP transport because of a FastMCP limitation. The authorization endpoints return 404 errors in that setup, so external HTTP clients should run the server without OAuth. If OAuth is configured for a supported scenario, token data is stored under `/home/vulnicheck/.vulnicheck/tokens`; a Docker volume can preserve it across restarts.

## Tools and capabilities

The vulnicheck MCP server exposes these tools:

- `check_package_vulnerabilities`: inspect one Python package for known vulnerabilities.
- `scan_dependencies`: analyze dependency files.
- `scan_installed_packages`: inspect installed Python packages.
- `get_cve_details`: retrieve details for a CVE.
- `scan_for_secrets`: search code for exposed credentials and secrets.
- `scan_dockerfile`: review Dockerfiles for vulnerable Python dependencies.
- `scan_github_repo`: run a broader security scan against a GitHub repository.
- `assess_operation_safety`: request an AI-assisted risk assessment for an operation.
- `validate_mcp_security`: check MCP server security configuration.
- `comprehensive_security_check`: conduct an interactive security assessment.

These capabilities suit dependency review, repository triage, secret detection, container checks, and MCP deployment validation.

## Limitations and notes

Basic scanning works without provider credentials, but external services may impose their own rate limits. AI-assisted assessments depend on the configured OpenAI or Anthropic provider. GitHub and NVD credentials are optional enhancements rather than startup requirements.

The documented unauthenticated ngrok setup encrypts traffic through HTTPS but allows anyone who has the URL to access the endpoint. OAuth should not be treated as a working access-control option for external HTTP clients until the stated FastMCP transport limitation is resolved.

_Full upstream README: https://allmcps.com/mcp/vulnicheck/readme_