vulnicheck — Claude Code MCP server: scanning and setup
A Docker-based HTTP MCP server that checks Python projects and GitHub repositories for vulnerabilities, exposed secrets, and Dockerfile issues.
Open on GitHubWhat vulnicheck does
vulnicheck runs in Docker as an HTTP MCP server and exposes tools for inspecting Python packages, dependency files, GitHub repositories, Dockerfiles, and MCP configurations. It can look up package vulnerabilities, inspect installed packages, find leaked credentials, return CVE details, and produce remediation guidance.
The server accepts requirements.txt, pyproject.toml, and setup.py for dependency checks. OpenAI or Anthropic keys enable AI-based risk analysis, while GITHUB_TOKEN and NVD_API_KEY provide higher API limits. Without an OpenAI key, the basic scanning path still works.
Claude Code connects to http://localhost:3000/mcp over HTTP. Google OAuth is available as an option, but the documented FastMCP limitation breaks authorization endpoints under HTTP transport and causes 404 responses for external clients.
What it helps with
- scan Python dependencies for known CVEs
- locate exposed secrets in source code
- inspect a Dockerfile for vulnerable packages
- check a GitHub repository for security issues
- validate an MCP server configuration
Example prompts for the agent
- Scan this project’s Python dependencies and report known vulnerabilities.
- Check
https://github.com/owner/repofor security problems. - Inspect my Dockerfile and MCP configuration for exposed risks.
How to install vulnicheck
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about vulnicheck
How do I install vulnicheck in Claude Code?
Pull the image with docker pull andrasfe/vulnicheck:latest, start it with docker run -d --name vulnicheck-mcp -p 3000:3000 --restart=unless-stopped andrasfe/vulnicheck:latest, then add it with claude mcp add --transport http vulnicheck http://localhost:3000/mcp.
What does vulnicheck do?
It checks Python dependencies, secrets, Dockerfiles, MCP settings, and GitHub repositories. It can also return CVE details and assess operational risk.
Do I need an API key to run vulnicheck?
Basic scanning works without OPENAI_API_KEY. OpenAI or Anthropic keys add AI risk analysis, while GITHUB_TOKEN and NVD_API_KEY increase the related API limits.
