Draugr

Install

Works with Claude Desktop. Read the repository before you give any tool access to your data.

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

13 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

None found

Runs as

Downloaded binary

Tools (13)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_tools

  Report which external scanners Draugr can find on this machine, and what to run if any are missing. Call this when a scan fails or before suggesting one: a control whose scanner is absent cannot run, and Draugr reports that as a failure rather than a pass. This only looks, it will not install anything.

• diff_reports

  Compare two scans and report what a change introduced and what it resolved. Ask this rather than summarize_report when the question is whether a change made things worse: a project with inherited findings answers 'what is wrong' the same way before and after, which says nothing about the change. Give failOnNew to learn whether a pull request gate would fail.

• explain_rule

  Explain what a finding means and how to fix it, from the scan's own report. Returns the check in full and the remediation the scanner published. Prefer this over fetching a rule's help URI: the answer is already on disk, and for a benchmark that URI is often a registration form in front of a PDF.

• feeds_status

  Report whether each dataset a scan reads from the local feed cache (CISA's KEV catalog, FIRST's EPSS scores, the Go vulnerability database) is cached, when it was fetched, and whether it is stale. Call this when a report marks a feed stale, when govulncheck fails offline, or before relying on exploitability ranking. It only reads, and when a feed is missing or stale it returns the `draugr feeds update` command for the user to run.

• fix_list

  Turn a report into the things to do about it, most urgent first, each saying how many findings it clears. Ask this rather than summarize_report when the question is what to change: one upgrade usually clears many findings, and an image somebody else publishes is one action however many packages are wrong inside it.

• get_saga_schema

  Return the JSON Schema for the Saga descriptor (*.saga.yaml) that this build of Draugr enforces. Use it to write or correct a descriptor rather than guessing at field names, the schema is the authority, and it rejects unknown keys.

• list_controls

  List the security controls Draugr can run: what each one checks, which scanner backs it, and whether it applies per component or to the whole project. Call this before writing or editing a Saga descriptor, so the controls you enable are ones that exist.

• list_surveyors

  Name the surveyors this build has and what each discovers. Call it before survey, so the surveyor you ask for is one that exists.

• propose_saga

  Return the Saga descriptor `draugr init` would write for a directory, as YAML, with the controls its dependency files, infrastructure code and Dockerfiles call for. Call this when a project has no descriptor, before writing one from get_saga_schema. It writes nothing; show the proposal to the user, who decides whether and where to save it.

• scan

  Description is built at runtime.

• summarize_report

  Read the results.sarif an earlier draugr scan wrote and return its findings ranked by priority, deduplicated, with the rule documentation link for each. Answers 'what should I fix first?' from a scan that already ran, without starting a new one. A finding the project accepted comes back in accepted, with who decided, why and until when; report it as a decision and do not propose fixing it. It covers the controls that scan ran and nothing else, so treat it as a floor to build on rather than a complete account of a codebase's security. Given a report.json, read the results.sarif in the same dire…

• survey

  Discover what an application is made of, the images running in a Kubernetes namespace, the repositories in an organization, and return a Saga descriptor for it. Prefer this over writing a descriptor from the schema: which namespaces exist and which images are actually running, at which digest, is not something to guess at. It reads a live system with credentials this machine already has, and returns YAML rather than writing a file.

• validate_saga

  Check a Saga descriptor against the schema and report what's wrong. Give either a path on disk or the YAML content directly. Validating is free and has no side effects, so prefer it over assuming an edit was correct.

Signals

Stars

8

Forks

2

Open issues

37

Last commit

Oct 24, 2026 (5 days ago)

Last release

Oct 26, 2026 (3 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

dev.draugr/draugr

Version

0.155.1

Auth

No auth

Packages

mcpb https://github.com/draugr-dev/draugr/releases/download/v0.155.1/draugr-0.155.1.mcpb

License

Apache-2.0

Repository

github.com/draugr-dev/draugr

Website

draugr.dev

First seen

Oct 24, 2026

Last checked

Oct 26, 2026

Source

Official MCP Registrygithub-graphql