Vulnicheck MCP Server

If you already use Vulnicheck, the vulnicheck mcp server is the piece that lets your assistant work with it directly. HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.

What the server does

VulniCheck provides comprehensive security analysis for Python projects and GitHub repositories using AI-powered vulnerability detection. It runs as a Docker-based HTTP MCP server with standard HTTP streaming (no SSE required), providing secure containerized deployment with comprehensive vulnerability scanning capabilities.

• Docker Deployment — Secure containerized deployment with HTTP streaming (no SSE/Server-Sent Events required)
• Optional Authentication — Supports Google OAuth 2.0 for secure access control (disabled by default)
• Production Ready — Scalable HTTP server architecture
• Comprehensive Coverage — Queries 5+ vulnerability databases (OSV.dev, NVD, GitHub Advisory, CIRCL, Safety DB)
• GitHub Integration — Scan any public/private GitHub repository directly (up to 1GB)
• AI-Powered Analysis — Uses OpenAI/Anthropic APIs for intelligent security assessment

Installation

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

Available tools

The toolset is worth reading before you wire it up, because it tells you what the integration is really for:

• check_package_vulnerabilities — Check a specific Python package for vulnerabilities
• scan_dependencies — Scan dependency files (requirements.txt, pyproject.toml, etc.)
• scan_installed_packages — Scan currently installed Python packages
• get_cve_details — Get detailed information about a specific CVE
• scan_for_secrets — Detect exposed secrets and credentials in code
• scan_dockerfile — Analyze Dockerfiles for vulnerable Python dependencies
• scan_github_repo — Comprehensive security scan of GitHub repositories
• assess_operation_safety — AI-powered risk assessment for operations
• validate_mcp_security — Validate MCP server security configurations
• comprehensive_security_check — Interactive AI-powered security assessment

Credentials and setup notes

Configuration is passed through the environment: FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID, FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET, FASTMCP_SERVER_BASE_URL, OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, NVD_API_KEY, GOOGLE_CLIENT_ID. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

• Docker - Claude Code or any MCP client with HTTP transport support (standard HTTP, no SSE required) - Optional: API keys for enhanced features

Worth knowing first

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 10 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Vulnicheck.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

Where it fits

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Vulnicheck's toolset — check_package_vulnerabilities, scan_dependencies, scan_installed_packages and 7 more — is a fair guide to whether it matches your workflow. It is maintained by andrasfe; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.