Skip to main content
Glama
Sign In

vdb

by kr.ai.vdb
OverviewDiscussionsAdmin

Server Details

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
0pstech/vdb-mcp
GitHub Stars
0
Server Listing
kr.ai.vdb/vdb
ChatGPT
–
Claude
–

TDQS

A3.7/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct action or resource: single vs bulk package checks, lockfile scanning, vulnerability lookup/search, slopsquatting listing, and MCP server vetting are clearly separated. The singular/plural package tools are explicitly distinguished by the description's preference guidance.

Naming Consistency4/5

All tools use the vdb_ prefix and snake_case, with mostly verb_noun naming (check_package, scan_lockfile, list_slopsquatting). Two tools (lookup, search) are verb-only, which is a minor deviation from the otherwise consistent pattern.

Tool Count5/5

Seven tools is well-scoped for a vulnerability and package-risk server. Each tool covers a meaningful operation without redundancy or obvious padding.

Completeness4/5

The surface covers the core lifecycle: checking single/bulk packages, scanning resolved lockfiles, looking up vulnerabilities, free-text search, slopsquatting listing, and MCP server vetting. A minor gap is the lack of a direct tool for checking a package version explicitly, though package names likely include version context.

Available Tools

7 tools
vdb_check_mcp_serverAInspect

BEFORE recommending a community/unofficial MCP server, check it here. Scope risk is evaluated independently of advisory risk — an unvetted publisher asking for shell or filesystem access is refused even with a clean record. Follow the returned agent_action.

Inputs: server_id (required).

vdb_check_packageAInspect

BEFORE recommending or installing any package, check it here. The response carries agent_action: REFUSE (do not add it — relay the because text to the user), CONFIRM (ask the user first), or PROCEED. A failed or rate-limited call also answers REFUSE; never proceed unchecked. Also returns the underlying advisories, slop risk, and KEV status as supporting data.

Inputs: purl (required), version.

vdb_check_packagesAInspect

Bulk-check several packages in one call — always prefer this over repeated vdb_check_package. Each result carries its own agent_action (REFUSE / CONFIRM / PROCEED) plus a top-level agent_action for the batch. Follow them; relay because when refusing. Send names EXACTLY as written — do not correct a typo first, the call is the typo test.

Inputs: packages (required).

vdb_list_slopsquattingBInspect

List packages currently flagged as slopsquatting candidates in a given ecosystem.

Inputs: limit, ecosystem.

vdb_lookupAInspect

Fetch a single vulnerability by ID or alias (e.g. CVE-2024-1234, GHSA-xxxx-yyyy-zzzz, VDB-SLOP-…).

Inputs: id (required).

vdb_scan_lockfileAInspect

BEFORE merging, scan the resolved lockfile. Checking the packages someone chose misses the transitive ones nobody did — which is usually where the risk is. Pass the file contents (package-lock.json, requirements.txt, uv.lock, go.sum, Cargo.lock, a CycloneDX SBOM, …). Returns agent_action: REFUSE means do not merge.

Inputs: filename (required), path, content.

vdb_searchCInspect

Free-text search over the VDB vulnerability corpus.

Inputs: query (required), limit.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • depscope-mcp

      cuttalo
      A
      license
      Not graded
      quality
      D
      maintenance
      Validates and checks packages across 19 ecosystems to prevent AI agents from installing hallucinated, deprecated, or malicious packages.
      55 npm
      AGPL 3.0

    • skedaddle

      altairzhambyl
      A
      license
      A
      quality
      C
      maintenance
      Enables AI agents and users to check npm, PyPI, and crates.io packages before installation for hallucinated names, malware, exact-version CVEs, and signs of compromised releases, with MCP tools for package checks and lockfile audits.
      2
      Apache 2.0

    • pkgbouncer

      rayan1810
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI coding agents to check package names and versions for allow/warn/deny verdicts, scan project lockfiles for known-malicious packages and critical advisories, and suggest safe versions across npm, PyPI, crates.io, and Go before manifests are edited.
      360 npm
      MIT
    Try in Browser
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    Glama MCP Gateway

    Add one secure layer between your agents and this server.

    Resources