Skip to contentvulnicheck MCP Server | MCPpediaVvulnicheck MCP Server
HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.
33LimitedInstall
~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"andrasfe-vulnicheck": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"docker.io/andrasfe/vulnicheck:main"
],
"env": {
"NVD_API_KEY": "YOUR_NVD_API_KEY",
"GITHUB_TOKEN": "YOUR_GITHUB_TOKEN",
"OPENAI_API_KEY": "YOUR_OPENAI_API_KEY",
"ANTHROPIC_API_KEY": "YOUR_ANTHROPIC_API_KEY",
"MCP_PORT": "",
"CACHE_TTL": "",
"VULNICHECK_HTTP_ONLY": ""
}
}
}
}
Related servers
XReal-time data-breach lookup and analytics for emails and domains from XposedOrNot.
Environment
| Name | Required | Notes |
|---|
| NVD_API_KEY | No | API key for NIST National Vulnerability Database (increases rate limit from 5 to 50 requests per 30 seconds) Secret. |
| GITHUB_TOKEN | No | GitHub token for Advisory Database access (increases rate limit to 5000 requests per hour) Secret. |
| OPENAI_API_KEY | No | OpenAI API key for LLM-based risk assessment in MCP passthrough operations Secret. |
| ANTHROPIC_API_KEY | No | Anthropic API key for LLM-based risk assessment (alternative to OpenAI) Secret. |
| MCP_PORT | No | Port for MCP HTTP server (default: 3000) |
| CACHE_TTL | No | Cache time-to-live in seconds for vulnerability data (default: 900) |
| VULNICHECK_HTTP_ONLY | No | Enable HTTP-only mode with MCP client delegation (true/false, default: auto-detect) |
Tools show up when the registry metadata or the repository README lists them. GitHub enrichment fills this in when a token is configured.
About
HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.
FAQ
- What is vulnicheck?
- HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.
- How do I install vulnicheck?
- Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.
- Is vulnicheck official?
- No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.
- How is the trust score calculated?
- This listing scores 33 (Limited). The formula is published on the methodology page.
Reviews
0 published · no average
Sign in to review this server.
Good
GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more.
NReact Native and Expo health check: upgrade blockers, store rules, crash risks, security findings
FFederated messaging with your fmsg hosting provider. Connect with OAuth or an API key.
SDeterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.
MCompact MCP server for SAP ABAP ADT over HTTP, RFC or SNC: one tool per operation, object in args