Ovecc MCP Server

CLI-first architecture intelligence: understand your codebase, then hold it to the rules you set. It runs locally over stdio via the published package.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Rust.

VERIFIED ACTIVE

LAST COMMIT 2026-08-22 · ★ 3 · #46 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MPL-2.0 · Rust servers · how we verify → /methodology

01 · Install Ovecc

Claude Code

claude mcp add ovecc-labs-ovecc -- npx -y ovecc

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "ovecc-labs-ovecc": {
      "command": "npx",
      "args": [
        "-y",
        "ovecc"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

repo age created 2026-07-11 - young repo, little track record yet

license MPL-2.0 - declared in the repository

npm package ovecc - unscoped; check the name against the project README before installing

registry namespace io.github.Ovecc-labs is GitHub-verified and matches the repo owner

03 · What Ovecc can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.3.1 · 2026-08-16

Changed · A tainted flow now requires a symbol on its path to read client-sent request · data (req.body, req.query, req.params, req.headers, req.cookies). · Reachability alone said that any route touching a table was a…

v0.3.0 · 2026-08-15

Changed · The licence is MPL-2.0. Releases up to and including v0.2.5 were published · under Apache-2.0 and remain available under it; the change applies from this · release forward. Files carrying a different…

v0.2.5 · 2026-08-11

Fixed · import type no longer inflates the persisted circular_dependencies metric. · The type-only filter landed in cycles.rs but never reached the SCC pass in · analyze_modules, so gate, diff, drift, history and the…

04 · Who maintains Ovecc

ovecc is maintained by ovecc-labs. It's the only MCP server we track from this author; the repo dates to Jul 2026.

05 · Facts

repository: github.com/ovecc-labs/ovecc
website: https://ovecc.dev/
category: security - ranked #46 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 9 releases in the last 90 days (latest 2026-08-16)
registry: io.github.Ovecc-labs/ovecc (active, first published 2026-08-08 · 4 versions)
packages: npm:ovecc

06 · Ovecc FAQ

What is Ovecc?

CLI-first architecture intelligence: understand your codebase, then hold it to the rules you set. It runs locally over stdio via the published package.

Is Ovecc still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-22 and it shipped 9 releases in the last 90 days. We re-verify nightly.

How do I install Ovecc?

Run `npx -y ovecc`. You can also paste the ready-made client config above.

Does Ovecc run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Ovecc

Alternatives to Ovecc

Maintained security servers if Ovecc isn't the fit.

Pairs well with

Servers that cover what Ovecc doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Pairoa · Fitbit MCP · DugganUSA CLI - Local STDIO MCP · Commit - Supply Chain Risk Scoring · SSH

More Rust MCP servers · Oxcode · Pmcp · Omen · Patchloom · Signet MCP Tools · see all