# Draugr

Draugr coordinates security tools from a single configuration file and ranks findings by actual exposure. It helps teams evaluate release risks and gates pull requests on newly introduced flaws.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 8
- Author: draugr-dev
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/draugr-dev/draugr
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/draugr

## What it does

Draugr runs established engines such as Trivy, Semgrep, and Gitleaks through a unified `draugr.saga.yaml` file. Instead of configuring separate scanners, you describe your services, images, and infrastructure once. The tool selects applicable checks for dependencies, exposed secrets, container images, and infrastructure code.

Traditional tools flag severity in isolation. Draugr calculates priority from P1 to P4 by checking whether an affected component faces the public internet. A high-severity flaw in a private internal helper will not derail your release.

In pull requests, `draugr diff` inspects only new issues. That keeps teams from getting stalled by inherited technical debt. Scanners must be fetched beforehand with `draugr tools install`.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- scan application dependencies for vulnerabilities with Trivy
- detect leaked secrets and committed credentials with Gitleaks
- check Terraform and Kubernetes manifests for misconfigurations
- block pull requests only when new security issues appear

## Example prompts
- Run a Draugr scan on this repo and report P1 priority issues
- Execute `draugr diff` to evaluate security findings introduced in this branch
- Create a `draugr.saga.yaml` descriptor for the project using `draugr survey`

## Similar
- [security-reviewer](https://affpapa.org/en/nevibecode/skills/security-reviewer.md) — skill · 6000 installs
- [devsecops-expert](https://affpapa.org/en/nevibecode/skills/devsecops-expert.md) — skill · 361 installs
- [senior-secops](https://affpapa.org/en/nevibecode/skills/senior-secops.md) — skill · 903 installs
- [PerspectiveGraph](https://affpapa.org/en/nevibecode/mcp/perspectivegraph.md) — MCP server · ★ 9
- [sast-configuration](https://affpapa.org/en/nevibecode/skills/sast-configuration.md) — skill · 10800 installs
- [sast-scanning](https://affpapa.org/en/nevibecode/skills/sast-scanning.md) — skill · 372 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md