Dvalincode

What dvalincode MCP server does

The dvalincode MCP server gives MCP-speaking coding agents access to local security checks and governed verification workflows. It operates on a project workspace and uses Dvalin’s built-in rules to detect issues such as injection, hardcoded secrets, cross-site scripting, eval, and unsafe shell usage. The default scan requires no account, model, API key, or remote service, and code remains on the machine running the server.

The dvalincode MCP server is intended to provide an independent check after an agent changes code. It does not ask the agent that made the change whether the repair worked. Instead, Dvalin can rescan the workspace, execute the project’s own checks, inspect process exit codes, and return evidence for the resulting verdict.

How it works

Start the MCP process with a workspace path. An MCP client sends scan or verification requests, and Dvalin evaluates the current files according to its security policy. Scans can cover the whole workspace or use diff: "uncommitted" to focus on changes the agent has just made. The latter is useful when a repository already contains findings that are outside the current task.

A verification workflow begins explicitly when an agent calls dvalin_begin_verification. The agent can then retrieve a specific issue by fingerprint and request an independent check. Dvalin records the initial and follow-up results, the checks it observed, the coverage status, and any newly introduced findings. A repair that removes one issue but introduces another is marked regressed rather than verified.

Fix records are small JSON artifacts that can be checked again from the file alone. Their hashes and verdicts are recomputed during verification, so edits made after issuance are detected. The record describes what was checked; it is not a general claim that the code is safe.

Setup and configuration

Run the server with the package runner and point it at the target workspace:

claude mcp add dvalin -- npx -y dvalincode mcp-serve --workspace .

The repository also provides a configuration command for supported editor formats:

npx dvalincode mcp-install cursor
npx dvalincode mcp-install vscode
npx dvalincode mcp-install claude-code

These commands write the appropriate configuration file and merge with existing entries. Cursor uses .cursor/mcp.json, VS Code uses .vscode/mcp.json, and Claude Code uses .mcp.json. The server itself needs no API key or model configuration for its built-in rules.

Tools and capabilities

The documented MCP operations include:

• dvalin_scan: scan the workspace, optionally limiting results to uncommitted changes.
• dvalin_begin_verification: create a local workflow for checking a repair.
• dvalin_get_finding: retrieve a finding using its fingerprint.
• dvalin_verify_findings: request an independent rescan and verification result.

The server does not edit the target workspace, run a model, or persist Dvalin state during a scan. It can inspect and execute the project checks needed for a verification record. Its results include whether scan coverage was complete, partial, or unknown, so an empty result can be distinguished from a fully covered clean run.

Limitations and notes

The built-in coding capability is a remediation executor, not the trust boundary for the verification result. The agent or person making a change is recorded, but is not consulted when Dvalin derives the verdict. Verification only establishes that the recorded findings and checks produced the stated evidence; it does not prove that the entire codebase is secure.

Optional scanner engines can be installed separately through the Dvalin CLI, but the default policy uses the built-in scanner. Suppressions require a reason and may include an owner and expiration date. The server is therefore most suitable when the workspace, its tests, and its security policy are available to the process running MCP.