Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents
Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents. Exposed over MCP by the flagrix mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
Scan GitHub repositories and profiles for malware before you clone — from the terminal, CI, or an AI agent. The same commit-pinned verdict as the Flagrix browser extension, made callable.
Installation goes through your MCP client rather than a global install: point it at flagrix on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
You will need 2 environment variables: GITHUB_TOKEN, FLAGRIX_GITHUB_TOKEN. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. It is maintained by flagrix-io; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Flagrix's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
{
"mcpServers": {
"flagrix": {
"command": "npx",
"args": ["-y", "flagrix"],
"env": {
"GITHUB_TOKEN": "your-value",
"FLAGRIX_GITHUB_TOKEN": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| GITHUB_TOKEN | Credential the server authenticates with. | Yes |
| FLAGRIX_GITHUB_TOKEN | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.