# Husk

Husk scans dependencies, secrets, install scripts, and AI agent settings for risks. Use it to inspect a project or check a package before adding it.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: husk-security
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/husk-security/husk
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/husk

## What it does

Husk scans a project for vulnerable dependencies, exposed secrets, hazardous install scripts, and risky AI agent or MCP settings. Findings appear in the terminal, a local web interface, or a terminal UI. Online checks send package names, versions, and CVE identifiers to public advisory sources; `--offline` runs without network requests.

Husk runs locally and can connect to Claude Code as an MCP server. Add it with `claude mcp add husk -- npx -y husk-sec`. It runs on Linux and macOS; Windows use requires WSL. The project is pre-1.0 and has not had an independent audit, so that matters when choosing a scanner.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add husk -- npx -y husk-sec
```

### Codex

**Platform CLI**
```bash
codex mcp add husk -- npx -y husk-sec
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "husk": {
            "command": "npx",
            "args": [
                "-y",
                "husk-sec"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "husk": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "husk-sec"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add husk npx -y husk-sec
```

## When to use it
- find known vulnerabilities in project dependencies
- locate exposed secrets in MCP settings
- spot hazardous package install scripts
- inspect AI agent configuration for risky access

## Example prompts
- Scan this project and report vulnerable dependencies and exposed secrets.
- Check this package for known vulnerabilities before I add it.
- Find risky MCP and AI agent settings in this project.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md