Husk — Claude Code MCP server: security scanning
Husk scans dependencies, secrets, install scripts, and AI agent settings for risks. Use it to inspect a project or check a package before adding it.
claude mcp add husk -- npx -y husk-secWhat Husk does
Husk scans a project for vulnerable dependencies, exposed secrets, hazardous install scripts, and risky AI agent or MCP settings. Findings appear in the terminal, a local web interface, or a terminal UI. Online checks send package names, versions, and CVE identifiers to public advisory sources; --offline runs without network requests.
Husk runs locally and can connect to Claude Code as an MCP server. Add it with claude mcp add husk -- npx -y husk-sec. It runs on Linux and macOS; Windows use requires WSL. The project is pre-1.0 and has not had an independent audit, so that matters when choosing a scanner.
What it helps with
- find known vulnerabilities in project dependencies
- locate exposed secrets in MCP settings
- spot hazardous package install scripts
- inspect AI agent configuration for risky access
Example prompts for the agent
- Scan this project and report vulnerable dependencies and exposed secrets.
- Check this package for known vulnerabilities before I add it.
- Find risky MCP and AI agent settings in this project.
How to install Husk
Platform CLI
claude mcp add husk -- npx -y husk-secPlatform CLI
codex mcp add husk -- npx -y husk-secConfig file
{
"mcpServers": {
"husk": {
"command": "npx",
"args": [
"-y",
"husk-sec"
]
}
}
}Config file
{
"servers": {
"husk": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"husk-sec"
]
}
}
}Platform CLI
gemini mcp add husk npx -y husk-secStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Husk
How do I install Husk in Claude Code?
Run claude mcp add husk -- npx -y husk-sec. This registers Husk as an MCP server.
What does Husk do?
It scans for vulnerable packages, exposed secrets, hazardous install scripts, and risky AI agent or MCP configuration. You can view findings in the terminal, local web interface, or terminal UI.
Can I run Husk on Windows?
Run it through WSL; Husk has no native Windows build. It runs directly on Linux and macOS.
