Vulnicheck MCP Server

VulniCheck provides comprehensive security analysis for Python projects and GitHub repositories using AI-powered vulnerability detection. It runs as a Docker-based HTTP MCP server with standard HTTP streaming (no SSE required), providing secure containerized deployment with comprehensive vulnerability scanning capabilities. Its 10 documented tools cover scan, check, security.

People who need cloud infrastructure tools inside Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-02-22 · ★ 11 · #135 OF 141 MAINTAINED CLOUD INFRASTRUCTURE · VERIFIED 2026-08-25

MIT · Python servers · how we verify → /methodology

01 · Install Vulnicheck

before you install - you'll need

Set FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID, FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET, FASTMCP_SERVER_BASE_URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, NGROK_URL, OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, NVD_API_KEY before connecting.

Docker

docker run -i --rm docker.io/andrasfe/vulnicheck:main

Claude Desktop - add to config

{
  "mcpServers": {
    "andrasfe-vulnicheck": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "docker.io/andrasfe/vulnicheck:main"
      ]
    }
  }
}

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as container (OCI image) - can be sandboxed away from your filesystem

license MIT - declared in the repository

registry namespace io.github.andrasfe is GitHub-verified and matches the repo owner

03 · What Vulnicheck can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can check a specific Python package for vulnerabilities, scan dependency files (requirements.txt, pyproject.toml, etc.), scan currently installed Python packages, and get detailed information about a specific CVE.

Capability map

Tools grouped from the project's README - what Vulnicheck lets an agent do.

Scan

5 tools - e.g. Scan dependency files (requirements.txt, pyproject.toml, etc.); Scan currently installed Python packages; Detect exposed secrets and credentials in code

scan_dependencies · scan_installed_packages · scan_for_secrets · scan_dockerfile · scan_github_repo

Check

1 tool - e.g. Check a specific Python package for vulnerabilities

check_package_vulnerabilities

read & search

1 tool - e.g. Get detailed information about a specific CVE

get_cve_details

Assess

1 tool - e.g. AI-powered risk assessment for operations

assess_operation_safety

Validate

1 tool - e.g. Validate MCP server security configurations

validate_mcp_security

Comprehensive

1 tool - e.g. Interactive AI-powered security assessment

comprehensive_security_check

04 · Who maintains Vulnicheck

vulnicheck is maintained by andrasfe. It's the only MCP server we track from this author; the repo dates to Jun 2025.

05 · Facts

repository: github.com/andrasfe/vulnicheck
category: cloud infrastructure - ranked #135 of 141 actively-maintained cloud infrastructure servers as of 2026-08-25.
registry: io.github.andrasfe/vulnicheck (active, first published 2025-09-19)
packages: oci:docker.io/andrasfe/vulnicheck:main

06 · Vulnicheck FAQ

Is Vulnicheck still maintained?

Yes - as of 2026-08-25, its last commit was 2026-02-22. We re-verify nightly.

What can Vulnicheck do?

How do I install Vulnicheck?

Run `docker run -i --rm docker.io/andrasfe/vulnicheck:main`. The README documents 10 environment variables (FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID, FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET, FASTMCP_SERVER_BASE_URL…) to set first. Set FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID, FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET, FASTMCP_SERVER_BASE_URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, NGROK_URL, OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, NVD_API_KEY before connecting. You can also paste the ready-made client config above.

07 · Alternatives to Vulnicheck

Alternatives to Vulnicheck

Maintained cloud infrastructure servers if Vulnicheck isn't the fit.

Pairs well with

Servers that cover what Vulnicheck doesn't - only shown when the pairing reason fits the companion.

More cloud infrastructure MCP servers · Devcontainer MCP · Antics MCP · Pronounce · Maven Tools MCP · State Sidecar

More Python MCP servers · Nodriver - Undetected Browser Automation · Datoon · Math MCP · Molecular MCP · Chess UCI · see all