Inkog MCP Server

Security companion for AI agent development in Claude, Cursor, and Claude Code. Its 7 documented tools cover inkog, audit. It runs locally over stdio via the published package.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-06-07 · ★ 3 · #90 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

Apache-2.0 · TypeScript servers · how we verify → /methodology

01 · Install Inkog

before you install - you'll need

INKOG_API_KEY

Environment variables documented in the project's README - it lists which are required and which have defaults.

Claude Code

claude mcp add inkog-io-inkog-mcp -- npx -y @inkog-io/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "inkog-io-inkog-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@inkog-io/mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package @inkog-io/mcp - published under the repo owner's npm scope (@inkog-io)

registry namespace io.github.inkog-io is GitHub-verified and matches the repo owner

03 · What Inkog can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

An agent gets 7 documented tools spanning inkog, audit, including inkog_scan, inkog_verify_governance, inkog_compliance_report, inkog_explain_finding.

The 7 tools it gives your agent

Extracted from the project's README - what inkog lets an agent do.

inkog_scan: - Static analysis for logic flaws and security risks
inkog_verify_governance: - Validate AGENTS.md declarations match actual code behavior
inkog_compliance_report: - Generate EU AI Act, NIST, OWASP compliance reports
inkog_explain_finding: - Get detailed remediation guidance for findings
inkog_audit_mcp_server: - Audit any MCP server before installation
inkog_generate_mlbom: - Generate ML Bill of Materials (CycloneDX, SPDX)
inkog_audit_a2a: - Audit Agent-to-Agent communications

Latest releases

v1.0.20 · 2026-03-21

What's New · Published to official MCP Registry (io.github.inkog-io/inkog) · Added Glama directory metadata · 7 security tools: scan, MCP audit, Skill scan, A2A audit, MLBOM, compliance report, governance verification

04 · Who maintains Inkog

inkog is maintained by inkog-io. It's the only MCP server we track from this author; the repo dates to Jan 2026.

05 · Facts

repository: github.com/inkog-io/inkog-mcp
category: security - ranked #90 of 182 actively-maintained security servers as of 2026-08-25.
registry: io.github.inkog-io/inkog (active, first published 2026-01-08 · 2 versions)
packages: npm:@inkog-io/mcp

06 · Inkog FAQ

Is Inkog still maintained?

Yes - as of 2026-08-25, its last commit was 2026-06-07. We re-verify nightly.

What can Inkog do?

An agent gets 7 documented tools spanning inkog, audit, including inkog_scan, inkog_verify_governance, inkog_compliance_report, inkog_explain_finding.

How do I install Inkog?

Run `npx -y @inkog-io/mcp`. The README documents one environment variable (INKOG_API_KEY) to set first. You can also paste the ready-made client config above.

Does Inkog run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Inkog

Alternatives to Inkog

Maintained security servers if Inkog isn't the fit.

Pairs well with

Servers that cover what Inkog doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Ironclaw · Scan MCP · Signet Eval · Shellward · Patch Tuesday

More TypeScript MCP servers · Ins Forge · Instagit · Context Sync · Lemonsqueezy MCP Server · Server Zotero Dev · see all