Vulnify

What Vulnify MCP server does

The Vulnify MCP server gives an AI agent a policy decision point before the agent performs a sensitive action. It proxies requests to https://api.vulnify.io and returns one of three authoritative outcomes: ALLOW, REVIEW, or BLOCK. An ALLOW permits the caller to continue, BLOCK prevents the action, and REVIEW waits for a person. The server itself cannot approve or deny a pending review.

The Vulnify MCP server does not store events or API keys. Its check_action operation is a dry run: it skips the PII scan and creates no event. decide_action creates a security event and audit entry. A failed MCP call is returned as a tool error rather than being treated as ALLOW.

How it works

The hosted endpoint is https://mcp.vulnify.io/mcp and uses stateless Streamable HTTP. Clients can authenticate through Vulnify’s OAuth 2.1 flow, select an organization, and grant scopes for decision and policy operations. API-key authentication is also supported through the Authorization: Bearer or X-Vulnify-Key header.

The seven available tools are check_action, decide_action, get_decision, list_policies, test_policies, plan_policy_changes, and check_mcp_tool_call. OAuth access exposes the first five according to granted scopes. API-key sessions expose all seven. get_decision can optionally poll a REVIEW result for up to 30 seconds. test_policies accepts up to 200 cases without saving proposed policies, while plan_policy_changes forces a dry run and requires an organization-wide LIVE key.

Setup and configuration

For hosted use, connect an MCP client to the endpoint and complete Sign in with Vulnify. Claude, Cursor, Grok, Claude Code, and VS Code are documented client options. OAuth credentials should be left empty when starting the hosted sign-in flow. An API key is appropriate when browser sign-in is unavailable or when access to the API-key-only tools is needed.

For local use, run npx -y @vulnify/mcp with Node.js 20 or newer and set VULNIFY_API_KEY. Keys use the vln_live_... or vln_test_... format. Test-key events are kept in the sandbox and do not appear in the main dashboards. The Vulnify MCP server does not open the OAuth consent page for local execution.

Tools and capabilities

• Test one action without recording it with check_action.
• Record a real authorization decision with decide_action.
• Retrieve an existing decision with get_decision.
• List policies as code with list_policies.
• Test up to 200 policy cases with test_policies.
• Preview policy changes with plan_policy_changes.
• Map an MCP tool name to an action and record the resulting check with check_mcp_tool_call.

Each tool includes MCP metadata hints such as read-only, destructive, idempotent, and open-world indicators. These hints affect client presentation only; they do not change execution.

Limitations and notes

A REVIEW outcome requires a person, and this server cannot resolve it. The finalDecision field must be used as the decision source; tool errors are not permission to proceed. OAuth scopes limit which tools are available, and plan_policy_changes plus check_mcp_tool_call require an API key. Application code that needs in-process decisions should use Vulnify’s Node SDK instead; this package does not depend on that SDK and reports transport failures as MCP tool errors rather than converting them to fail-closed decisions.