Log inSubmit server
Husk logo

Husk

Local-first scanner for vulnerable dependencies, leaked secrets, risky scripts, and unsafe AI or MCP configuration.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Husk

Pick your client, then add it in one click or paste the config.

No confirmed install command yet

We only publish a config when the install details come from the project itself — its README, its docs, or a verified owner. We haven’t found those for Husk, and we’d rather show nothing than a guess you’d paste into your client.

Open setup steps on GitHub

Overview

The Husk MCP server connects AI-agent workflows to Husk’s local security scanner and CLI. Husk scans dependencies, secrets, install scripts, and AI/MCP configuration, with reports available in terminal, JSON, TUI, or a local web UI. Use it when an agent needs locally run defensive checks without sending files off the machine. Online advisory lookups send package metadata and CVE IDs to public databases; offline mode makes no network calls.

Use cases

  • Scan a project for vulnerable dependencies and leaked secrets
  • Check a package before adding it to a project
  • Gate CI builds on security finding severity
  • Review unsafe AI and MCP configuration locally
  • Apply selected auto-safe fixes with backups

Key features

  • Local scanning for dependencies, secrets, scripts, and AI/MCP configuration
  • Package malware and vulnerability checks
  • Offline mode with zero network calls
  • JSON reports for automation and CI
  • Project policies and trust decisions
  • MCP entry point through the Husk CLI

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

7/7 checks healthy over the last 62d

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars6Stargazers on the source repository.
Last commit6d agoMost recent push to the default branch.

How Husk works

What Husk MCP server does

The Husk MCP server brings Husk’s local security checks into an MCP-based agent workflow. Husk is a command-line security scanner for developer machines and project directories, focused on compromised or vulnerable packages, exposed secrets, risky install scripts, and unsafe AI or MCP settings.

Its underlying scanner can inspect a directory, check an individual package, produce a findings report, gate CI builds, and apply selected fixes. Project policies stored in .husk/policy.toml can define package decisions, suppressed findings, and CI thresholds. Trust decisions can also be recorded in Husk’s personal ledger.

How it works

Husk runs as a local binary. The CLI entry point for the MCP interface is husk mcp, which can run the MCP server or register it with an AI agent.

The scanner itself keeps its state locally. Reports, scan indexes, ledger data, daemon state, and credentials use local directories by default. Normal online advisory lookups send package names, versions, and CVE identifiers to public sources including OSV.dev, npm, PyPI, GitHub, CISA KEV, and FIRST EPSS. Passing --offline disables network calls.

Setup and configuration

Husk supports Linux and macOS. Windows users must run it through WSL; there is no native Windows build. The documented installer places the binary in ~/.local/bin, and the installation directory can be changed with HUSK_INSTALL_DIR or --install-dir. Cargo, cargo-binstall, npm, and Nix are also supported installation paths.

Run husk mcp to start or register the MCP interface.

Useful configuration variables include HUSK_HOME for state, HUSK_CACHE_DIR for cached reports and indexes, HUSK_PAGER or PAGER for long CLI output, NO_COLOR to disable ANSI colors, and HUSK_TOKEN for cloud-command bearer-token overrides. None is documented as mandatory for the local scanner or MCP command.

Tools and capabilities

The Husk MCP server is backed by commands that can:

  • Scan a directory and print or export a findings report.
  • Check a package version against malware and vulnerability advisories.
  • Read the latest scan without rescanning.
  • Gate a build with a severity threshold and JSON output.
  • Plan fixes, with --apply writing auto-safe changes and backups.
  • Create and inspect project policy, approve packages, or suppress findings.
  • Open the latest report in a terminal UI or local web UI.
  • Run periodic scans through the daemon command.

JSON reports are emitted by scan, status, TUI, and CI workflows. The report format includes an API version and is stored in the local cache for the interfaces to render.

Limitations and notes

Husk is pre-1.0 software and has not had an independent audit; interfaces may change between releases. Treat those as implementation details requiring repository or release-specific verification.

Local scanning does not mean every operation is offline. Advisory lookups use external public databases unless offline mode is selected.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Husk

Husk is an MCP server that connects AI agents to the local Husk security scanner, providing access to directory scans, package checks, findings reports, and policy-aware project checks. It runs through the Husk CLI and supports local defensive analysis of dependencies, secrets, install scripts, and AI or MCP configuration.

Install Husk first, then run `husk mcp` to run or register its MCP interface. The documented installation options include the signed shell installer, `cargo install husk-sec`, `cargo binstall husk-sec`, `npm install -g husk-sec`, and Nix. Linux and macOS are supported; Windows requires WSL.

It states that `husk mcp` can run the MCP server or register it with an AI agent, but it provides no client-specific configuration or compatibility list.

Yes, `--offline` makes zero network calls.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewHusk AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/husk?style=directory)](https://allmcps.com/mcp/husk)
HTML Embed
<a href="https://allmcps.com/mcp/husk"><img src="https://allmcps.com/api/badge/husk?style=directory" alt="Husk on AllMCPs" /></a>