VPNDetection vs Codeinspectus
A side-by-side look at the VPNDetection and Codeinspectus MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose VPNDetection for security work as a local process; choose Codeinspectus for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose VPNDetection when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You have the keys it needs:
VPNDETECTION_API_KEY, VPNDETECTION_BASE_URL. - You want tools like
lookup_ip, lookup_ips, my_entitlement.
Choose Codeinspectus when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
codeinspectus_scan, codeinspectus_setup, codeinspectus_rescan.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 63/100 · Good | 68/100 · Great |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | No auth required |
| Pricing | Freemium | Free |
| Required env vars | VPNDETECTION_API_KEYVPNDETECTION_BASE_URL | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 1 | 48 |
| Directory activity | 1 views 0 installs 0 upvotes | 7 views 0 installs 0 upvotes |
| Tools | 7 | 7 |
| Full listing | View VPNDetection | View Codeinspectus |
Tools & capabilities
VPNDetection tools 7
lookup_ipClassify a single IPv4 or IPv6 address: whether it belongs to a VPN, a residential, datacenter, mobile or public proxy, a Tor node, a privacy relay or web gateway, a hosting provider or a CDN, with the provider name where we have one. Private and reserved addresses are answered locally and cost nothing. Always read `coverage.note` before concluding anything from a field that is not in the result.lookup_ipsClassify a list of addresses in one call, returning a map keyed by address so duplicates collapse and the order you passed them stops mattering. Pass the whole list rather than splitting it yourself: a long one is batched for you. Prefer this over repeated `lookup_ip` calls when you already have the list, for example when triaging a log file. An address that fails carries its error in place of a result rather than failing the batch. Always read `coverage.note` before concluding anything from a field that is not in the result.my_entitlementWhat this API key is entitled to and how much of it has been used: the plan, the field tier that decides how much of a lookup answer comes back, the requests counted so far, the allowance, and when it resets. Use it to explain why a field is missing from a lookup, or before a large batch. Usage counts against the anniversary of the subscription rather than the calendar month, and can lag a few seconds behind. A null `hard_limit` means we never stop serving - it is NOT a limit of zero.list_databasesThe database catalog as this API key's organization may see it, one entry per database FAMILY, with `standing` saying where their license stands: `licensed` if the family is theirs today, `expired` if the term has ended, `unlicensed` if it is published but has never been bought. Each entry has a `base` id, which is what the license names, and a `versions` array whose `id` is what the other database tools take - pass `versions[].id` (`cdn_ip_v1`), never the `base` (`cdn_ip`). Ask again rather than holding on to this: it is answered per key and is not the same for everyone.database_metadataWhat is inside one database before you fetch it: the columns in each published format with their types, a few sample rows, the row count, the build date and the file sizes. Use this to answer questions about what a database contains without downloading it - the files reach several GB - and to budget a transfer before starting one.database_checksumThe published digests for one database file, for verifying a copy you already hold or deciding whether a build has changed since you last fetched it. It is licensed like the download itself, so a database this key cannot download is refused here too. Looking up a checksum is not a download and does not appear in `list_downloads`.list_downloadsThis organization's own recent download attempts, newest first, REFUSALS INCLUDED - a denial carries the `outcome` and `http_status` that answer "it stopped working", which nothing else here can. Use it to explain a failing fetch, to confirm a transfer ran, or to check whether a request was theirs. This is a bounded WINDOW of at most 200 rows, so a database missing from the answer means it is not in this window - never that it was never downloaded.
Codeinspectus tools 7
codeinspectus_scanRun a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. V3.2 additionally audits explicit AI attribution in source/git/media metadata and validates supported local C2PA assets with the official optional Content Authenticity Initiative library. Remote manifests and revocation endpoints are never fetched. Statistical-watermark detection remains explicitly unavailable. Fully offline — zero network egress at scan time. Never writes to your code or repo.codeinspectus_setupInspect external-engine health and exact platform download sizes, save declined choices, or install selected Opengrep/Gitleaks/Trivy components after explicit confirmation. Plan is offline. Install writes only to ~/.codeinspectus, verifies immutable pins/publisher provenance, and never modifies the target repository.codeinspectus_rescanRe-run a scan after fixes were applied and diff against a prior scan_id (or the most recent scan of the same path). Reports which findings are resolved, which remain, and which were newly introduced, plus fresh technology and native-pack execution coverage. Repository-trust artifacts are diffed separately with fail-closed resolved, remaining, introduced and not-rechecked states. Use this to verify approved fixes. Never writes to your code or repo.codeinspectus_compliance_reportProduce a per-framework code-level control-coverage view for a prior scan (NIST CSF 2.0, ISO 27001:2022, SOC 2, CIS v8.1, Essential Eight, OWASP Web/LLM). Reports 'X of N code-visible controls have findings' with the code-visible subset as the explicit denominator. This is NOT a compliance audit, certification, or attestation — code-level evidence only.codeinspectus_explain_findingReturn a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.codeinspectus_generate_sbomGenerate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.codeinspectus_list_rulesList the active detectors and engine versions, the CodeInspectus detection-database version and date, Trivy vulnerability-DB freshness, bundled Pub advisory-database provenance/freshness, and the custom CodeInspectus AI-code rules and native detector packs currently shipped.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
VPNDetection
{
"mcpServers": {
"vpndetection": {
"command": "npx",
"args": [
"-y",
"vpndetection-mcp"
],
"env": {
"VPNDETECTION_API_KEY": "YOUR_VPNDETECTION_API_KEY_HERE",
"VPNDETECTION_BASE_URL": "YOUR_VPNDETECTION_BASE_URL_HERE"
}
}
}
}
Codeinspectus
{
"mcpServers": {
"synvoya-codeinspectus": {
"command": "npx",
"args": [
"-y",
"codeinspectus"
]
}
}
}
Frequently asked questions
VPNDetection is categorized under Security and uses a local stdio subprocess. Codeinspectus belongs to Security and uses a local stdio subprocess. Pick VPNDetection for security work and Codeinspectus for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
VPNDetection is listed as freemium — a free tier with paid plans. Codeinspectus is listed as free. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add vpndetection and synvoya-codeinspectus as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, VPNDetection has a quality signal of 63/100 (Good) with 1 views, 0 installs and 1 GitHub stars. Codeinspectus has 68/100 (Great) with 7 views, 0 installs and 48 GitHub stars.