BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent
BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep. The boostsecurity mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 2 defined tools rather than through you.
The following languages and package ecosystems are supported in this release:
Agentic AI systems can accelerate software delivery by autonomously suggesting or adding code and dependencies. However, without the right safeguards, they can also introduce significant supply chain risks by pulling in third-party packages that:
Everything the assistant can do here goes through one of these:
validate_package — Validates whether a package is safe to use. If the package is unsafe, a recommended alternative is providedRequirements — Go to: Settings -> Cursor Settings -> MCP -> Add new global MCP serverSettings -> Cursor Settings -> MCP -> Add new global MCP server See Cursor MCP docs for more info.Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. BoostSecurity's toolset — validate_package, Requirements — is a fair guide to whether it matches your workflow.
This entry was verified against BoostSecurity's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| validate_package | Validates whether a package is safe to use. If the package is unsafe, a recommended alternative is provided. |
| Requirements | Go to: Settings -> Cursor Settings -> MCP -> Add new global MCP server |
{
"mcpServers": {
"boost-security": {
"url": "https://mcp.boostsecurity.io/mcp",
"transport": "http"
}
}
}Configuration as documented by the project. Restart the client after saving.
Settings -> Cursor Settings -> MCP -> Add new global MCP server See Cursor MCP docs for more info.Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.