Vulnicheck

Install

Pick your client. Read the repository before you give any tool access to your data.

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

14 read · 4 write · 0 delete · 3 not yet classified

Secrets

None asked for

Install scripts

Not scanned yet

Runs as

Docker image

Tools (21)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• approve_mcp_operation

  Approve a pending MCP operation that requires security approval. USE THIS TOOL WHEN: - You receive a security approval request for an MCP operation - You've analyzed the operation and determined it's safe - The operation aligns with the user's intent The approval decision should consider: - Whether the operation matches the user's stated goals - If the risk is acceptable for the current context - Whether there are safer alternatives available

• assess_operation_safety

  Assess the safety of an operation BEFORE execution. USE THIS TOOL WHEN: - Before performing file write/delete operations - Before executing system commands - Before making API calls with potential side effects - When you need to evaluate operation risks - When implementing potentially dangerous functionality The tool will: 1. Use LLM-based risk assessment when available (OpenAI/Anthropic API keys configured) 2. Fall back to structured risk patterns if no LLM is available 3. Provide specific risks, recommendations, and whether human approval is needed For operations without LLM support, retu…

• check_package_vulnerabilities

  Check a SINGLE Python package for known vulnerabilities. USE THIS TOOL WHEN: - You need to check if a specific Python package has vulnerabilities - You want to check a particular version of a package - The user asks about vulnerabilities in a named package like "requests" or "django" DO NOT USE THIS TOOL FOR: - Scanning multiple packages (use scan_dependencies or scan_installed_packages instead) - Checking MCP server security (use validate_mcp_security instead) - Finding secrets in code (use scan_for_secrets instead) - Getting details about a specific CVE ID (use get_cve_details instead) Qu…

• check_public_url

  Check VulniCheck's detected public URL and compare with configuration. This tool detects the public URL from HTTP request headers (useful when behind ngrok or other reverse proxies) and compares it with the configured base URL. USE THIS TOOL WHEN: - You want to verify VulniCheck is accessible from the correct public URL - You're using ngrok and want to confirm the tunnel URL is detected correctly - You need to troubleshoot OAuth redirect URI mismatches - You want to verify FASTMCP_SERVER_BASE_URL configuration Returns: A report showing detected URL, configured URL, and any warnings or r…

• comprehensive_security_check

  Comprehensive interactive security check (requires LLM configuration). This tool performs a thorough security assessment by: 1. Discovering available resources (dependencies, Dockerfiles, MCP configs) 2. Asking clarifying questions one at a time 3. Running relevant security scans based on your confirmations 4. Using LLM to analyze and synthesize all findings 5. Generating a comprehensive report with risk scoring and recommendations REQUIRES: OPENAI_API_KEY or ANTHROPIC_API_KEY to be configured. Args: action: Action to perform: 'start' to begin a new check, 'continue' to continue an inte…

• deny_mcp_operation

  Deny a pending MCP operation that requires security approval. USE THIS TOOL WHEN: - You receive a security approval request for an MCP operation - You've determined the operation is too risky - There are safer alternatives to achieve the goal Always provide a clear reason and suggest alternatives when possible.

• get_cve_details

  Get detailed information about a SPECIFIC CVE or GHSA identifier. USE THIS TOOL WHEN: - You have a specific CVE ID (e.g., 'CVE-2021-44228') - You have a GitHub Security Advisory ID (e.g., 'GHSA-jfh8-c2jp-5v3q') - The user asks for details about a particular vulnerability by its ID - You need CVSS scores, affected products, or references for a known CVE DO NOT USE THIS TOOL FOR: - General package vulnerability scanning (use other scan tools instead) - Checking MCP configurations (use validate_mcp_security instead) - Finding vulnerabilities without knowing the CVE ID - Searching for secrets in…

• get_mcp_conversations

  Retrieve stored conversations between clients and MCP servers. This tool returns conversations that VulniCheck has intermediated, including requests, responses, and risk assessments. Conversations are stored locally in .vulnicheck/conversations directory. Returns: Formatted list of conversations with their messages

• install_vulnicheck_guide

  Installation guide for Claude Code users who want to install VulniCheck. Provides step-by-step instructions for installing VulniCheck MCP server.

• list_mcp_servers

  List available MCP servers and their tools. USE THIS TOOL WHEN: - You want to see what MCP servers are available - You need to discover what tools each server provides - Before using mcp_passthrough_tool to know what's available Returns a list of configured MCP servers and their available tools.

• manage_trust_store

  Manage the MCP server trust store. This tool allows you to view and manage trusted MCP server configurations. The trust store helps prevent unauthorized server configuration changes. USE THIS TOOL WHEN: - You need to view trusted MCP servers - You want to add a new server to the trust store - You need to remove an untrusted server - You want to verify if a server configuration is trusted Returns a report of the action performed.

• mcp_passthrough_tool

  Execute an MCP tool call through an enhanced security passthrough layer with risk assessment. USE THIS TOOL WHEN: - You need to call a tool on another MCP server - The LLM wants to access external MCP server capabilities - You need to add security constraints to MCP calls DO NOT USE THIS TOOL FOR: - Direct vulnerability scanning (use the specific scan tools instead) - Internal tool calls within this server This tool acts as a security layer between the LLM and MCP servers, intercepting calls and providing risk-based security enforcement: Risk Levels: - BLOCKED: Always blocked operations (r…

• scan_dependencies

  Scan dependency file CONTENT for vulnerabilities. USE THIS TOOL WHEN: - You have the content of a requirements.txt, pyproject.toml, setup.py, Pipfile.lock, or poetry.lock file - You want to scan all dependencies in a project - The user asks to "scan my project" or "check my dependencies" - You need to analyze dependency file contents for vulnerabilities - You have a zip file containing dependency files to scan DO NOT USE THIS TOOL FOR: - Checking a single package (use check_package_vulnerabilities instead) - Scanning the current Python environment (use scan_installed_packages instead) - Chec…

• scan_dockerfile

  Scan a Dockerfile for Python dependencies and check for vulnerabilities. This tool analyzes Dockerfiles to extract Python package installations and checks them for known vulnerabilities. USE THIS TOOL WHEN: - You need to check vulnerabilities in Docker images - You want to analyze Python dependencies in Dockerfiles - You need to audit container security for Python packages - You have a zip file containing Dockerfiles to scan INPUT OPTIONS (specify exactly one): - dockerfile_path: Absolute path to a Dockerfile - dockerfile_content: Content of a Dockerfile as string - zip_content: Base64 enco…

• scan_for_secrets

  Scan file CONTENTS for exposed SECRETS and credentials (NOT vulnerabilities). USE THIS TOOL WHEN: - You need to find exposed API keys, passwords, or tokens in code - The user asks to "check for secrets" or "find exposed credentials" - You want to scan source code for hardcoded sensitive information - Security audit requires checking for leaked credentials - You have a zip file containing source code to scan for secrets DO NOT USE THIS TOOL FOR: - Finding package vulnerabilities (use check_package_vulnerabilities or scan_dependencies) - Checking MCP configurations (use validate_mcp_security i…

Signals

Stars

11

Forks

3

Open issues

0

Last commit

Feb 22, 2026 (8 months ago)

Last release

Sep 19, 2025 (1 year ago)

Last package publish

Feb 22, 2026 (8 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.andrasfe/vulnicheck

Version

0.1.0

Auth

API key

Packages

oci docker.io/andrasfe/vulnicheck:main

License

MIT

Repository

github.com/andrasfe/vulnicheck

First seen

Oct 24, 2026

Last checked

Oct 25, 2026

Source

Official MCP Registrygithub-graphql