Log inSubmit server
Vulnicheck logo

Vulnicheck

Scans Python projects and GitHub repositories for vulnerabilities, secrets, Dockerfile risks, CVE details, and MCP security issues.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Vulnicheck

Run the project’s own setup commands, in order.

Setup steps from the project

vulnicheck installs with its own commands rather than a config we can generate, so these are copied as-is. Run them in order in a terminal. Source: github.com

  1. 1. Install
    docker pull andrasfe/vulnicheck:latest
  2. 2. Start the server
    docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  -e OPENAI_API_KEY=your-openai-api-key \
  andrasfe/vulnicheck:latest
  3. 3. Start the server
    docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  andrasfe/vulnicheck:latest
  4. 4. Add to Claude Code
    claude mcp add --transport http vulnicheck http://localhost:3000/mcp
  5. 5. Start the server
    docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  -e OPENAI_API_KEY=your-key \           # AI-powered risk assessment
  6. 6. Start the server
    docker run -d --name vulnicheck-mcp -p 3000:3000 \
     --restart=unless-stopped \
     -e FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID=your-client-id \
     -e FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET=your-secret \
     -e FASTMCP_SERVER_BASE_URL=http://localhost:3000 \
     -v vulnicheck_tokens:/home/vulnicheck/.vulnicheck/tokens \
     andrasfe/vulnicheck:latest \
     python -m vulnicheck.server --auth-mode google

Overview

The vulnicheck MCP server exposes Python security scanning and risk-assessment tools through a Docker-based HTTP MCP endpoint. It checks dependency files, installed packages, Dockerfiles, source code secrets, CVEs, GitHub repositories, and MCP configurations. Optional OpenAI and Anthropic keys add AI-assisted assessments, while GitHub and NVD keys can improve API rate limits. Reach for it when an agent needs to review Python dependencies, repository security, or deployment configuration.

Use cases

  • Scan Python dependency files for known vulnerabilities
  • Review GitHub repositories for security issues
  • Detect exposed secrets in source code
  • Inspect Dockerfiles for vulnerable Python dependencies
  • Validate MCP security configurations

Key features

  • Python package and dependency vulnerability scanning
  • Installed-package inspection
  • CVE detail lookup
  • Secrets and credential detection
  • GitHub repository and Dockerfile analysis
  • AI-assisted security assessments

Tools10

What Vulnicheck lets your agent do. Expand a tool for its parameters.

Self-reported~169 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

18/19 checks healthy over the last 91d

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars11Stargazers on the source repository.
Last commit8mo agoMost recent push to the default branch.
Tools exposed10Callable tools this server registers over MCP.
Directory activity4 viewsConfig copies, upvotes, and views on AllMCPs.

How Vulnicheck works

What vulnicheck MCP server does

The vulnicheck MCP server gives an MCP client access to security checks for Python projects and GitHub repositories. It can inspect dependency declarations such as requirements.txt, pyproject.toml, and setup.py, review packages installed in an environment, and look up information for a supplied CVE.

Code-oriented checks include exposed secrets and credentials, while Dockerfile analysis focuses on vulnerable Python dependencies. Repository scanning accepts public or private GitHub repositories and supports repositories up to 1 GB, according to the project documentation. The server also includes checks for MCP security configurations and interactive security assessments.

Its vulnerability coverage queries multiple sources, including OSV.dev, NVD, GitHub Advisory, CIRCL, and Safety DB. Scan results may include remediation recommendations. Commit-level caching is used to avoid repeating identical repository scans, and automatic cleanup limits stored data to 2 GB.

How it works

The vulnicheck MCP server runs as a Docker container and exposes a streamable HTTP MCP endpoint. The documented local endpoint is http://localhost:3000/mcp; the container listens on port 3000. HTTP streaming is used without Server-Sent Events.

A client sends tool requests through MCP rather than invoking a command-line scanner directly. Available operations include package checks, dependency and installed-package scans, CVE lookups, secret detection, Dockerfile analysis, GitHub repository scans, operation safety assessment, MCP configuration validation, and a broader interactive security check.

The container can run without API keys for basic vulnerability scanning. OpenAI or Anthropic credentials enable the documented AI-assisted assessment features. A GitHub token can provide higher GitHub API rate limits, and an NVD key can provide higher NVD limits.

Setup and configuration

The quickest setup is to pull andrasfe/vulnicheck:latest from Docker Hub and publish container port 3000. Claude Code can then register the endpoint with its HTTP transport and the /mcp path. The repository also documents building a local image from source with Docker.

No environment variable is required for the basic container startup. Optional variables include OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, and NVD_API_KEY.

Google OAuth 2.0 configuration is documented, but it is disabled by default and currently does not work correctly with the HTTP transport because of a FastMCP limitation. The authorization endpoints return 404 errors in that setup, so external HTTP clients should run the server without OAuth. If OAuth is configured for a supported scenario, token data is stored under /home/vulnicheck/.vulnicheck/tokens; a Docker volume can preserve it across restarts.

Tools and capabilities

The vulnicheck MCP server exposes these tools:

  • check_package_vulnerabilities: inspect one Python package for known vulnerabilities.
  • scan_dependencies: analyze dependency files.
  • scan_installed_packages: inspect installed Python packages.
  • get_cve_details: retrieve details for a CVE.
  • scan_for_secrets: search code for exposed credentials and secrets.
  • scan_dockerfile: review Dockerfiles for vulnerable Python dependencies.
  • scan_github_repo: run a broader security scan against a GitHub repository.
  • assess_operation_safety: request an AI-assisted risk assessment for an operation.
  • validate_mcp_security: check MCP server security configuration.
  • comprehensive_security_check: conduct an interactive security assessment.

These capabilities suit dependency review, repository triage, secret detection, container checks, and MCP deployment validation.

Limitations and notes

Basic scanning works without provider credentials, but external services may impose their own rate limits. AI-assisted assessments depend on the configured OpenAI or Anthropic provider. GitHub and NVD credentials are optional enhancements rather than startup requirements.

The documented unauthenticated ngrok setup encrypts traffic through HTTPS but allows anyone who has the URL to access the endpoint. OAuth should not be treated as a working access-control option for external HTTP clients until the stated FastMCP transport limitation is resolved.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Vulnicheck

vulnicheck is an MCP server that connects AI clients to Python project and GitHub repository security checks. Its main tools scan dependencies, installed packages, Dockerfiles, repositories, and source code for vulnerabilities or secrets, retrieve CVE details, validate MCP security settings, and assess operational risk with optional AI providers.

Install it by pulling the `andrasfe/vulnicheck:latest` Docker image, publishing port 3000, and configuring your MCP client with `http://localhost:3000/mcp`. You can also clone the repository, build the image locally, and run the resulting container.

Yes, vulnicheck works with Claude Code through its HTTP transport. After starting the container on port 3000, register it with `claude mcp add --transport http vulnicheck http://localhost:3000/mcp`.

No, an OpenAI API key is not required for basic vulnerability scanning. `OPENAI_API_KEY` enables the documented AI-powered risk assessment features, and an Anthropic key can be used as an alternative provider.

No, the documented Google OAuth setup does not currently work correctly with external HTTP clients. A FastMCP limitation causes the authorization endpoints to return 404 errors, so the project recommends running without OAuth for external access.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewVulnicheck AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/vulnicheck?style=directory)](https://allmcps.com/mcp/vulnicheck)
HTML Embed
<a href="https://allmcps.com/mcp/vulnicheck"><img src="https://allmcps.com/api/badge/vulnicheck?style=directory" alt="Vulnicheck on AllMCPs" /></a>