# vulnicheck

A Docker-based HTTP MCP server that checks Python projects and GitHub repositories for vulnerabilities, exposed secrets, and Dockerfile issues.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 11
- Author: andrasfe
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/andrasfe/vulnicheck
- Updated: 2026-02-22
- HTML: https://affpapa.org/en/nevibecode/mcp/vulnicheck

## What it does

vulnicheck runs in Docker as an HTTP MCP server and exposes tools for inspecting Python packages, dependency files, GitHub repositories, Dockerfiles, and MCP configurations. It can look up package vulnerabilities, inspect installed packages, find leaked credentials, return CVE details, and produce remediation guidance.

The server accepts `requirements.txt`, `pyproject.toml`, and `setup.py` for dependency checks. OpenAI or Anthropic keys enable AI-based risk analysis, while `GITHUB_TOKEN` and `NVD_API_KEY` provide higher API limits. Without an OpenAI key, the basic scanning path still works.

Claude Code connects to `http://localhost:3000/mcp` over HTTP. Google OAuth is available as an option, but the documented FastMCP limitation breaks authorization endpoints under HTTP transport and causes 404 responses for external clients.

## Requirements
- Needs: Docker
- Environment variables: `NVD_API_KEY`, `GITHUB_TOKEN`, `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `MCP_PORT`, `CACHE_TTL`, `VULNICHECK_HTTP_ONLY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- scan Python dependencies for known CVEs
- locate exposed secrets in source code
- inspect a Dockerfile for vulnerable packages
- check a GitHub repository for security issues
- validate an MCP server configuration

## Example prompts
- Scan this project’s Python dependencies and report known vulnerabilities.
- Check `https://github.com/owner/repo` for security problems.
- Inspect my Dockerfile and MCP configuration for exposed risks.

## Similar
- [dependabot](https://affpapa.org/en/nevibecode/skills/dependabot.md) — skill · 4400 installs
- [access-review](https://affpapa.org/en/nevibecode/skills/access-review.md) — skill · 337 installs
- [saas-security-posture](https://affpapa.org/en/nevibecode/skills/saas-security-posture.md) — skill · 314 installs
- [make-repo-contribution](https://affpapa.org/en/nevibecode/skills/make-repo-contribution.md) — skill · 11073 installs
- [secrets-in-git-history](https://affpapa.org/en/nevibecode/skills/secrets-in-git-history.md) — skill · 1900 installs
- [github-code-review](https://affpapa.org/en/nevibecode/skills/github-code-review.md) — skill · 1300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md