Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
vdb-mcp
mcp-name: kr.ai.vdb/vdb
MCP (Model Context Protocol) server for VDB — the AI-aware vulnerability database. Lets Claude Desktop, Claude Code, Cursor, Cline, Continue, and any MCP client check packages while generating code: known CVEs, slopsquatting (LLM-hallucinated package names an attacker may have registered), CISA KEV status, MCP-server trust profiles, and more.
Quick start
Claude Desktop (claude_desktop_config.json) / Cursor (.cursor/mcp.json):
No install at all — point any streamable-HTTP MCP client at the hosted endpoint:
That's it — the server talks to the hosted instance at https://vdb.ai.kr
by default. Anonymous use gets a free per-IP trial; add an API key for
unmetered access (free at https://vdb.ai.kr/signup):
Tools
| Tool | What it does |
|---|---|
vdb_check_package | Check one package (purl + optional version) for vulnerabilities, slop risk, KEV |
vdb_check_packages | Bulk slopsquatting / risk check for a list of packages |
vdb_lookup | Fetch one advisory by ID (CVE-…, GHSA-…, VDB-SLOP-…) |
vdb_search | Free-text search over the vulnerability corpus |
vdb_check_mcp_server | Trust tier + permission scopes of a community MCP server |
vdb_list_slopsquatting | Current slopsquatting candidates per ecosystem |
Environment
| Variable | Default | Meaning |
|---|---|---|
VDB_API_URL | https://vdb.ai.kr | VDB instance to query (set for self-hosted) |
VDB_API_TOKEN | (empty) | vdb_… API key — unmetered, per-account quota |
MCP_MODE | stdio | stdio or sse (long-running HTTP server) |
MCP_PORT | 7700 | SSE port |
Why
LLMs hallucinate package names; attackers register them (slopsquatting).
LLMs also happily recommend packages with known RCEs. VDB gives your agent a
guardrail: one tool call before npm install / pip install. See
https://vdb.ai.kr/connect for the one-line prompt variant that needs no MCP
at all.
License
Elastic License 2.0 — free to use, including inside commercial organizations and CI. The only restrictions: you may not offer this software to third parties as a hosted or managed service, or resell it as a product. Commercial licensing beyond that: dev@egdee.com. API usage is governed by the VDB service terms regardless of how you call it.
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Vdb
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/vdb-2)HTML Embed
<a href="https://allmcps.com/mcp/vdb-2"><img src="https://allmcps.com/api/badge/vdb-2?style=directory" alt="Vdb on AllMCPs" /></a>