MCP server CX Codex

Draugr — Claude Code MCP server: what it does, how to install

Q: How to install Draugr in Claude Code?

Run `curl -fsSL https://draugr.dev/install.sh | sh` to place the binary into `~/.local/bin`. Then run `draugr init` to generate `draugr.saga.yaml` and execute `draugr tools install` to download required scanners.

Draugr coordinates security tools from a single configuration file and ranks findings by actual exposure. It helps teams evaluate release risks and gates pull requests on newly introduced flaws.

Open on GitHub

What Draugr does

Draugr runs established engines such as Trivy, Semgrep, and Gitleaks through a unified draugr.saga.yaml file. Instead of configuring separate scanners, you describe your services, images, and infrastructure once. The tool selects applicable checks for dependencies, exposed secrets, container images, and infrastructure code.

Traditional tools flag severity in isolation. Draugr calculates priority from P1 to P4 by checking whether an affected component faces the public internet. A high-severity flaw in a private internal helper will not derail your release.

In pull requests, draugr diff inspects only new issues. That keeps teams from getting stalled by inherited technical debt. Scanners must be fetched beforehand with draugr tools install.

What it helps with

scan application dependencies for vulnerabilities with Trivy
detect leaked secrets and committed credentials with Gitleaks
check Terraform and Kubernetes manifests for misconfigurations
block pull requests only when new security issues appear

Example prompts for the agent

Run a Draugr scan on this repo and report P1 priority issues
Execute draugr diff to evaluate security findings introduced in this branch
Create a draugr.saga.yaml descriptor for the project using draugr survey

How to install Draugr

Install

The MCP registry has no launch command for it: see the repository README

Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more

Questions about Draugr

How to install Draugr in Claude Code?

Run curl -fsSL https://draugr.dev/install.sh | sh to place the binary into ~/.local/bin. Then run draugr init to generate draugr.saga.yaml and execute draugr tools install to download required scanners.

What does Draugr do?

It orchestrates SAST, SCA, and secret scanning through a single descriptor. All detected vulnerabilities are weighted and prioritized based on exposure and component reachability.

How does P1–P4 priority differ from severity?

Severity measures a bug's theoretical worst-case impact. Draugr's priority considers whether the flawed component is reachable from the network and how critical it is to operations.

Similar MCP servers

All MCP servers for Security →

security-reviewer https://github.com/Jeffallan Finds code and infrastructure vulnerabilities, assigns severity ratings, and suggests fixes. Use it for audits, secret scanning, and dependency checks. CX Codex +1 6,000installs devsecops-expert martinholovsky Guides security checks for CI/CD, containers, and infrastructure as code. Use it when adding security gates to a build pipeline. CX Codex +1 361installs senior-secops Alireza Rezvani Checks source code, dependencies and security controls. Use it before an audit, after a CVE, or when adding checks to CI/CD. 903installs PerspectiveGraph luiacuaniello Turns your scanner output into one graph and answers whether someone can reach a sensitive asset from the internet. Useful when the findings pile up and the order to fix them is unclear. CX Codex +1 ★ 9repo stars sast-configuration Seth Hobson Configures SAST checks for finding vulnerabilities in application code. Useful for CI/CD setup, custom rules, and security policy checks. CX Codex 10,800installs sast-scanning devops-skills A skill that walks through static application security testing, so flaws in source code surface before deployment. Handy when you wire a security gate into CI/CD. CX Codex +1 372installs