GhostFree

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": [
        "-y",
        "ghostfree"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

What is GhostFree 🚫👻?

Every software team could use some help ridding their code base of the ghosts haunting their dependencies.

GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.

Quick Start

No installation, signup, or payment required. Add GhostFree to your MCP settings for whatever code tool you use and run /ghostfree.scan.

VS Code Copilot (Extension — easiest)

Search @mcp ghostfree in the Extensions view (Ctrl+Shift+X) and click Install. Then open the Command Palette (Ctrl+Shift+P), run MCP: List Servers, select GhostFree, choose Start Server, and confirm trust when prompted. No JSON config needed.

VS Code Copilot (Manual config)

Create or update .vscode/mcp.json in your project root:

config.json

{
  "servers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "${workspaceFolder}"],
      "env": {}
    }
  }
}

Claude Code

Create .mcp.json in your project root:

config.json

{
  "mcpServers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Cursor

Create .cursor/mcp.json:

config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Claude Desktop

Add to your claude_desktop_config.json (location varies by OS):

config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "/path/to/your/repo"]
    }
  }
}

How to Use

The `/ghostfree.scan` Prompt

The recommended way to run a scan is via the built-in prompt. In your AI client, type:

Code

/ghostfree.scan

This drives the following flow:

Discover — finds all manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, etc.)
Threshold — asks you for a minimum severity level (CRITICAL / HIGH / MEDIUM / LOW) if not already configured
Scan — queries OSV.dev for CVEs across all discovered packages
Triage — presents numbered results, 10 at a time. You pick which ones to investigate.
Enrich — fetches CVSS vectors, CWE classification, and CISA KEV "actively exploited" status for your selections
Remediate — recommends upgrades, code changes, or risk acceptance with a reason and expiry date

Example Session

Code

User: /ghostfree.scan

GhostFree: Discovering dependencies...
Found 84 packages across 2 ecosystems (npm, PyPI).

What minimum severity should I surface? (CRITICAL / HIGH / MEDIUM / LOW)

User: HIGH

GhostFree: Scanning against OSV.dev...

[1] CVE-2021-44228 CRITICAL (10.0) — org.apache.logging.log4j:log4j-core@2.14.1
    Log4Shell: Remote code execution via JNDI lookup
    Fix: upgrade to 2.17.1

[2] CVE-2022-25881 HIGH (7.5) — http-cache-semantics@4.1.0
    ReDoS in http-cache-semantics
    Fix: upgrade to 4.1.1

[3] CVE-2021-28918 CRITICAL (9.8) — netmask@1.0.6
    IP address parsing bypass (SSRF / allowlist bypass)
    Fix: upgrade to 1.1.0

Showing 1-3 of 3. Which would you like to investigate? (e.g., 1, 2, or 'all')

User: 3

GhostFree: [Calls enrich_cve CVE-2021-28918]

CVE-2021-28918 — netmask CRITICAL (9.8)
CVSS: 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-704 (Incorrect Type Conversion)
CISA KEV: Not listed

What it is: netmask@1.0.6 improperly parses octal-notation IP addresses (e.g. 010.0.0.1),
treating them as decimal. This enables SSRF protection bypass and IP allowlist/blocklist
bypass — an attacker can craft an address that appears private but routes to a public host.

Exploit status: Not in CISA KEV. Public PoC exists (SICK-2021-011), ~280k affected projects.

Codebase exposure: netmask is not directly imported — it appears in package-lock.json as a
transitive dependency of pac-resolver@3.0.0 (a transitive dev dependency). No direct
require('netmask') or IP parsing logic found. Reachability is very low.

Recommendation: Upgrade — low effort, patch version (1.0.6 → 1.1.0), no API changes.
netmask is a transitive dependency; use npm audit fix or add a package.json overrides entry
to force netmask@1.1.0.

→ Reply with a number to investigate another CVE, 'back' to return to the list,
  'fix' to apply the recommended fix, 'accept' to record an accepted risk, or 'done' to wrap up.

Example: Accepting a Known Risk

Code

User: Accept CVE-2022-25881 — it's only in our CI test pipeline, not reachable in production. Expiry end of year.

GhostFree: [Calls accept_risk CVE-2022-25881]

Accepted risk recorded:
• CVE-2022-25881 — http-cache-semantics (HIGH, CVSS 7.5)
  Reason: Only used in CI test pipeline, not reachable in production
  Expires: 2026-12-31
  ID: 550e8400-e29b-41d4-a716-446655440000

This acceptance is saved to .ghostfree/accepted.yml. Commit this file to share the
decision with your team. The CVE will be suppressed on future scans until expiry.

User: List all accepted risks

GhostFree: [Calls list_accepted_risks]

## Accepted Risks (1)

**CVE-2022-25881** — ✅ expires in 272 days (2026-12-31) | Severity at acceptance: HIGH (7.5)
  ID: 550e8400-e29b-41d4-a716-446655440000
  Reason: Only used in CI test pipeline, not reachable in production
  Accepted: 2026-04-03T10:00:00.000Z

Example: Enriching a Specific CVE

Code

User: Tell me everything about CVE-2021-44228

GhostFree: [Calls enrich_cve CVE-2021-44228]

## Enrichment: CVE-2021-44228

### NVD
CVSS Score: 10.0 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-917 (Improper Neutralization of Special Elements in an Expression Language Statement)

References:
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://logging.apache.org/log4j/2.x/security.html

### CISA KEV
⚠️ CONFIRMED actively exploited in the wild (added to KEV: 2021-12-10)

Tools Reference

Tool	Read-only	Description
`discover_dependencies`	✅	Scan repo manifests, return all pinned packages by ecosystem
`check_cves`	✅	Query OSV.dev for CVEs, filter by severity, apply accepted risks
`enrich_cve`	✅	Fetch CVSS, CWE, references from NVD + KEV exploitation status
`list_accepted_risks`	✅	List all accepted risks with expiry status and severity snapshot
`accept_risk`	❌	Record an accepted risk with reason, expiry date, and severity snapshot
`remove_accepted_risk`	❌	Remove an accepted risk by UUID

All read-only tools are safe to auto-approve in your MCP client. Write tools (accept_risk, remove_accepted_risk) will prompt for confirmation.

`check_cves` Inputs

Parameter	Required	Description
`packages`	Yes	Array of `{name, version, ecosystem}` — use `discover_dependencies` output
`min_severity`	No	`CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`. If not passed in, resolves in order of: `GHOSTFREE_MIN_SEVERITY` env var, then `.ghostfree/config.yml`, then prompts to choose

`accept_risk` Inputs

Parameter	Required	Description
`cve_id`	Yes	CVE ID, e.g. `CVE-2021-44228`
`reason`	Yes	Business justification
`expires_on`	Yes	Expiry date in `YYYY-MM-DD` format
`confirm_extended_expiry`	No	Set `true` if expiry is more than 1 year away
`severity`	Yes	Severity label at time of acceptance (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `UNKNOWN`) — snapshot, not live
`cvss_score`	No	CVSS score at time of acceptance — snapshot, not live

Configuration

Create .ghostfree/config.yml in your repo root to set a persistent severity threshold that's shared with your team via source control:

yaml

min_severity: HIGH

This takes priority over the environment variable. If neither is set, GhostFree will prompt you to choose at scan time.

Environment Variables

Variable	Description
`NVD_API_KEY`	Optional NVD API key for higher rate limits (50 req/30s vs 5 req/30s)
`GHOSTFREE_MIN_SEVERITY`	Optional — skip the severity prompt and always use this threshold (`CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`)
`GHOSTFREE_DIR`	Optional — use a custom directory instead of `.ghostfree/` (applies to both `accepted.yml` and `config.yml`)

VS Code extension users: create a .env file in your workspace root — the extension reads it automatically and forwards the values to the server. For all other setups (manual MCP JSON config): add these to the "env" block in your client's config file (.vscode/mcp.json, .mcp.json, .cursor/mcp.json, claude_desktop_config.json, etc.), or export them as system environment variables.

Accepted Risk Management

When you accept a risk, GhostFree writes it to .ghostfree/accepted.yml in your repo root. Commit this file to share accepted decisions with your team.

yaml

accepted_risks:
  - id: 550e8400-e29b-41d4-a716-446655440000
    cve_id: CVE-2022-25881
    reason: Only used in CI test pipeline, not reachable in production
    expires_on: "2027-01-01"
    accepted_at: "2026-04-02T10:00:00.000Z"
    severity_at_acceptance: HIGH
    cvss_score_at_acceptance: 7.5

Rules:

expires_on is required — no open-ended acceptances
Expiry within 1 year: accepted immediately
Expiry beyond 1 year: requires confirm_extended_expiry=true
Expired acceptances are never silently dropped — they resurface as warnings on every scan

Supported Ecosystems & Manifests

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about GhostFree

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "ghostfree": { "command": "npx", "args": ["-y", "GhostFree"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/ghostfree?style=directory)](https://allmcps.com/mcp/ghostfree)

HTML Embed

<a href="https://allmcps.com/mcp/ghostfree"><img src="https://allmcps.com/api/badge/ghostfree?style=directory" alt="GhostFree on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

28Quality signal: Emerging · 28/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools12/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

AllMCPs Server

The official MCP server for AllMCPs.com - submit and manage tools directly from your AI. The open directory for MCP servers. Connect Claude, Cursor, Windsurf, and AI agents to databases, tools, files, and APIs. Explore 10,000+ servers. AllMCPs is the premier, open directory for discovering, evaluating, and installing Model Context Protocol (MCP) servers to equip AI agents and LLMs with real-world superpowers.

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to GhostFree →Install in Claude Desktop Install in Cursor Install in VS Code

GhostFree

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": [
        "-y",
        "ghostfree"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

What is GhostFree 🚫👻?

Every software team could use some help ridding their code base of the ghosts haunting their dependencies.

Quick Start

No installation, signup, or payment required. Add GhostFree to your MCP settings for whatever code tool you use and run /ghostfree.scan.

VS Code Copilot (Extension — easiest)

VS Code Copilot (Manual config)

Create or update .vscode/mcp.json in your project root:

config.json

{
  "servers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "${workspaceFolder}"],
      "env": {}
    }
  }
}

Claude Code

Create .mcp.json in your project root:

config.json

{
  "mcpServers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Cursor

Create .cursor/mcp.json:

config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Claude Desktop

Add to your claude_desktop_config.json (location varies by OS):

config.json

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "/path/to/your/repo"]
    }
  }
}

How to Use

The `/ghostfree.scan` Prompt

The recommended way to run a scan is via the built-in prompt. In your AI client, type:

Code

/ghostfree.scan

This drives the following flow:

Discover — finds all manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, etc.)
Threshold — asks you for a minimum severity level (CRITICAL / HIGH / MEDIUM / LOW) if not already configured
Scan — queries OSV.dev for CVEs across all discovered packages
Triage — presents numbered results, 10 at a time. You pick which ones to investigate.
Enrich — fetches CVSS vectors, CWE classification, and CISA KEV "actively exploited" status for your selections
Remediate — recommends upgrades, code changes, or risk acceptance with a reason and expiry date

Example Session

Code

User: /ghostfree.scan

GhostFree: Discovering dependencies...
Found 84 packages across 2 ecosystems (npm, PyPI).

What minimum severity should I surface? (CRITICAL / HIGH / MEDIUM / LOW)

User: HIGH

GhostFree: Scanning against OSV.dev...

[1] CVE-2021-44228 CRITICAL (10.0) — org.apache.logging.log4j:log4j-core@2.14.1
    Log4Shell: Remote code execution via JNDI lookup
    Fix: upgrade to 2.17.1

[2] CVE-2022-25881 HIGH (7.5) — http-cache-semantics@4.1.0
    ReDoS in http-cache-semantics
    Fix: upgrade to 4.1.1

[3] CVE-2021-28918 CRITICAL (9.8) — netmask@1.0.6
    IP address parsing bypass (SSRF / allowlist bypass)
    Fix: upgrade to 1.1.0

Showing 1-3 of 3. Which would you like to investigate? (e.g., 1, 2, or 'all')

User: 3

GhostFree: [Calls enrich_cve CVE-2021-28918]

CVE-2021-28918 — netmask CRITICAL (9.8)
CVSS: 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-704 (Incorrect Type Conversion)
CISA KEV: Not listed

What it is: netmask@1.0.6 improperly parses octal-notation IP addresses (e.g. 010.0.0.1),
treating them as decimal. This enables SSRF protection bypass and IP allowlist/blocklist
bypass — an attacker can craft an address that appears private but routes to a public host.

Exploit status: Not in CISA KEV. Public PoC exists (SICK-2021-011), ~280k affected projects.

Codebase exposure: netmask is not directly imported — it appears in package-lock.json as a
transitive dependency of pac-resolver@3.0.0 (a transitive dev dependency). No direct
require('netmask') or IP parsing logic found. Reachability is very low.

Recommendation: Upgrade — low effort, patch version (1.0.6 → 1.1.0), no API changes.
netmask is a transitive dependency; use npm audit fix or add a package.json overrides entry
to force netmask@1.1.0.

→ Reply with a number to investigate another CVE, 'back' to return to the list,
  'fix' to apply the recommended fix, 'accept' to record an accepted risk, or 'done' to wrap up.

Example: Accepting a Known Risk

Code

User: Accept CVE-2022-25881 — it's only in our CI test pipeline, not reachable in production. Expiry end of year.

GhostFree: [Calls accept_risk CVE-2022-25881]

Accepted risk recorded:
• CVE-2022-25881 — http-cache-semantics (HIGH, CVSS 7.5)
  Reason: Only used in CI test pipeline, not reachable in production
  Expires: 2026-12-31
  ID: 550e8400-e29b-41d4-a716-446655440000

This acceptance is saved to .ghostfree/accepted.yml. Commit this file to share the
decision with your team. The CVE will be suppressed on future scans until expiry.

User: List all accepted risks

GhostFree: [Calls list_accepted_risks]

## Accepted Risks (1)

**CVE-2022-25881** — ✅ expires in 272 days (2026-12-31) | Severity at acceptance: HIGH (7.5)
  ID: 550e8400-e29b-41d4-a716-446655440000
  Reason: Only used in CI test pipeline, not reachable in production
  Accepted: 2026-04-03T10:00:00.000Z

Example: Enriching a Specific CVE

Code

User: Tell me everything about CVE-2021-44228

GhostFree: [Calls enrich_cve CVE-2021-44228]

## Enrichment: CVE-2021-44228

### NVD
CVSS Score: 10.0 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-917 (Improper Neutralization of Special Elements in an Expression Language Statement)

References:
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://logging.apache.org/log4j/2.x/security.html

### CISA KEV
⚠️ CONFIRMED actively exploited in the wild (added to KEV: 2021-12-10)

Tools Reference

Tool	Read-only	Description
`discover_dependencies`	✅	Scan repo manifests, return all pinned packages by ecosystem
`check_cves`	✅	Query OSV.dev for CVEs, filter by severity, apply accepted risks
`enrich_cve`	✅	Fetch CVSS, CWE, references from NVD + KEV exploitation status
`list_accepted_risks`	✅	List all accepted risks with expiry status and severity snapshot
`accept_risk`	❌	Record an accepted risk with reason, expiry date, and severity snapshot
`remove_accepted_risk`	❌	Remove an accepted risk by UUID

All read-only tools are safe to auto-approve in your MCP client. Write tools (accept_risk, remove_accepted_risk) will prompt for confirmation.

`check_cves` Inputs

Parameter	Required	Description
`packages`	Yes	Array of `{name, version, ecosystem}` — use `discover_dependencies` output
`min_severity`	No	`CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`. If not passed in, resolves in order of: `GHOSTFREE_MIN_SEVERITY` env var, then `.ghostfree/config.yml`, then prompts to choose

`accept_risk` Inputs

Parameter	Required	Description
`cve_id`	Yes	CVE ID, e.g. `CVE-2021-44228`
`reason`	Yes	Business justification
`expires_on`	Yes	Expiry date in `YYYY-MM-DD` format
`confirm_extended_expiry`	No	Set `true` if expiry is more than 1 year away
`severity`	Yes	Severity label at time of acceptance (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `UNKNOWN`) — snapshot, not live
`cvss_score`	No	CVSS score at time of acceptance — snapshot, not live

Configuration

Create .ghostfree/config.yml in your repo root to set a persistent severity threshold that's shared with your team via source control:

yaml

min_severity: HIGH

This takes priority over the environment variable. If neither is set, GhostFree will prompt you to choose at scan time.

Environment Variables

Variable	Description
`NVD_API_KEY`	Optional NVD API key for higher rate limits (50 req/30s vs 5 req/30s)
`GHOSTFREE_MIN_SEVERITY`	Optional — skip the severity prompt and always use this threshold (`CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`)
`GHOSTFREE_DIR`	Optional — use a custom directory instead of `.ghostfree/` (applies to both `accepted.yml` and `config.yml`)

Accepted Risk Management

When you accept a risk, GhostFree writes it to .ghostfree/accepted.yml in your repo root. Commit this file to share accepted decisions with your team.

yaml

accepted_risks:
  - id: 550e8400-e29b-41d4-a716-446655440000
    cve_id: CVE-2022-25881
    reason: Only used in CI test pipeline, not reachable in production
    expires_on: "2027-01-01"
    accepted_at: "2026-04-02T10:00:00.000Z"
    severity_at_acceptance: HIGH
    cvss_score_at_acceptance: 7.5

Rules:

expires_on is required — no open-ended acceptances
Expiry within 1 year: accepted immediately
Expiry beyond 1 year: requires confirm_extended_expiry=true
Expired acceptances are never silently dropped — they resurface as warnings on every scan

Supported Ecosystems & Manifests

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about GhostFree

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "ghostfree": { "command": "npx", "args": ["-y", "GhostFree"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/ghostfree?style=directory)](https://allmcps.com/mcp/ghostfree)

HTML Embed

<a href="https://allmcps.com/mcp/ghostfree"><img src="https://allmcps.com/api/badge/ghostfree?style=directory" alt="GhostFree on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

28Quality signal: Emerging · 28/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools12/30

Adoption & activity1/15

Community engagement0/10

★ Featured

AllMCPs Server

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to GhostFree →Install in Claude Desktop Install in Cursor Install in VS Code

GhostFree

Quick Install

Client Config & Setup

Documentation Overview

What is GhostFree 🚫👻?

Quick Start

VS Code Copilot (Extension — easiest)

VS Code Copilot (Manual config)

Claude Code

Cursor

Claude Desktop

How to Use

The /ghostfree.scan Prompt

Example Session

Example: Accepting a Known Risk

Example: Enriching a Specific CVE

Tools Reference

check_cves Inputs

accept_risk Inputs

Configuration

Environment Variables

Accepted Risk Management

Supported Ecosystems & Manifests

Related MCP Servers

Reviews

Frequently Asked Questions about GhostFree

AllMCPs Directory Badge

Technical Specs & Signals

AllMCPs Server

Own this project?

Share & Embed

Explore more

GhostFree

Quick Install

Client Config & Setup

Documentation Overview

What is GhostFree 🚫👻?

Quick Start

VS Code Copilot (Extension — easiest)

VS Code Copilot (Manual config)

Claude Code

Cursor

Claude Desktop

How to Use

The /ghostfree.scan Prompt

Example Session

Example: Accepting a Known Risk

Example: Enriching a Specific CVE

Tools Reference

check_cves Inputs

accept_risk Inputs

Configuration

Environment Variables

Accepted Risk Management

Supported Ecosystems & Manifests

Related MCP Servers

Reviews

Frequently Asked Questions about GhostFree

AllMCPs Directory Badge

Technical Specs & Signals

AllMCPs Server

Own this project?

Share & Embed

Explore more

The `/ghostfree.scan` Prompt

`check_cves` Inputs

`accept_risk` Inputs

The `/ghostfree.scan` Prompt

`check_cves` Inputs

`accept_risk` Inputs