dvalincode — Claude Code MCP server: security fix verification
Security scanner that verifies fixes independently of the agent and produces an offline-verifiable JSON proof.
claude mcp add dvalincode -- npx -y dvalincodeWhat dvalincode does
Dvalincode scans code for injection, XSS, hardcoded secrets, unsafe eval and shell calls. When an agent or human fixes a finding, the server re-scans on its own, runs the project's tests, and reads process exit codes. Who made the repair — Claude Code, Codex, Copilot, a person — is recorded but not consulted for the verdict.
The result is a dvalin-fix-record/v3 file with fields: findings before and after, which checks passed, what new issues appeared. You can verify it on any machine without network using dvalin verify-fix fix-record.json. The server works with built-in rules (no API keys) and can plug in Semgrep, Snyk Code, Snyk OSS — the same engines your CI gate uses.
Full verification requires a git repository: when judging a fix, the server resets ignore files (.snyk, .semgrepignore) to the base commit state and blanks fresh suppression markers in code. If a finding was hidden with a new ignore rather than fixed, the record gets regressed status and fails verification.
What it helps with
- verify that an agent's fix actually removed the vulnerability
- run the same scanners that block merges in CI
- catch evasion: the fix added an ignore instead of a real repair
- get a verification record you can re-check offline without Dvalin
Example prompts for the agent
- Scan the project for vulnerabilities using built-in rules and Snyk Code
- Check whether my fix passed verification for findings from the last scan
- Run a fix loop until clean results, using Semgrep and built-in rules
How to install dvalincode
Platform CLI
claude mcp add dvalincode -- npx -y dvalincodePlatform CLI
codex mcp add dvalincode -- npx -y dvalincodeConfig file
{
"mcpServers": {
"dvalincode": {
"command": "npx",
"args": [
"-y",
"dvalincode"
]
}
}
}Config file
{
"servers": {
"dvalincode": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"dvalincode"
]
}
}
}Platform CLI
gemini mcp add dvalincode npx -y dvalincodeStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about dvalincode
How to install dvalincode in Claude Code?
Run claude mcp add dvalincode -- npx -y dvalincode. For Codex the command is the same, just codex mcp add. For Cursor and GitHub Copilot add a JSON config with command: npx and args: ["-y", "dvalincode"].
What does dvalincode do?
It scans code for vulnerabilities, verifies fixes independently of who made them, and produces a JSON record with re-scan results and test runs. The record can be verified offline without an API.
Why does full verification need a git repository?
To detect evasion: the server resets ignore files to the base commit state and blanks new suppression markers, so a hidden finding does not count as fixed. Without a repository, verification is simplified and uses v2 record format.
