Vulnary-MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lookup_cveA | Fetch details, severity, and references for a CVE ID from NVD |
| check_packageA | Query OSV.dev for known vulnerabilities in a specific package + version. Requires the ecosystem (npm, PyPI, etc.) to disambiguate packages with the same name across registries. |
| scan_dependenciesB | Batch-check a list of named dependencies (with versions) against OSV.dev. |
| scan_dependency_fileA | Parse the raw contents of a package.json or requirements.txt file and check every listed dependency against OSV.dev. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool targets a clearly distinct use case: CVE lookup, single-package query, batch dependency scan, and manifest file parsing. The overlap between check_package and scan_dependencies is well-delineated by single-item vs. batch/list operations, so an agent should not misselect.
All tool names follow a consistent verb_noun snake_case pattern with purposeful verbs: lookup, check, scan, scan. This makes the action and target of each tool predictable and easy to reason about.
Four tools is a well-scoped set for a vulnerability lookup and dependency scanning server. Each tool earns its place and there is no redundancy or unnecessary bloat.
The tool surface covers the core vulnerability workflow: fetching CVE details, querying a single package, scanning a dependency list, and parsing a manifest file. No significant lifecycle or workflow gaps exist for the stated purpose.