Skip to main content
Glama
abhishekrai43

VulScan-MCP

by abhishekrai43
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

VulScan-MCP šŸ›”ļø

Scan your dependencies for security vulnerabilities (CVEs) directly in VS Code

Ask Copilot: "Check for vulnerabilities" ā†’ Get instant CVE reports with fix instructions.

Quick Start

  1. Install: Search "VulScan-MCP" in VS Code Extensions

  2. Requirement: Python 3.11+ installed (Download)

  3. Use: Ask Copilot: "Check for security vulnerabilities"

That's it! Dependencies auto-install on first use.

Related MCP server: VulnPilot

What You Get

### 1. lodash @ 4.17.15

#### šŸ“¦ Library Affected
- Package: lodash
- Current Version: 4.17.15
- Severity: HIGH

#### šŸ” CVE Details  
- CVE IDs: CVE-2021-23337, CVE-2020-28500
- What is it: Command injection vulnerability allowing attackers to execute arbitrary code

#### āœ… Mitigation Steps
āš ļø WARNING: Version upgrade required. Test in staging first.
1. Update package.json: "lodash": "^4.17.21"
2. Run: npm install
3. Run full test suite
4. Deploy to staging and monitor

Supported

Languages: JavaScript, TypeScript, Python, Java, Go, Rust, Ruby, PHP, C++, .NET
Sources: NVD (National Vulnerability Database) + OSV (Open Source Vulnerabilities)
Platforms: Windows, macOS, Linux

What It Checks

āœ… Security vulnerabilities (CVEs) - Known exploitable flaws
āŒ NOT deprecated packages - This tool is CVE-focused only

Note: Clean results mean no CVEs found - packages may still be outdated but secure.

Troubleshooting

Python not found?
Install Python 3.11+ globally, then restart VS Code.

"No module named 'mcp'" error? 

python3 -m pip install --user mcp requests

Still issues? Check logs:

  • Windows: %TEMP%\vulscan-mcp-debug.log

  • macOS/Linux: /tmp/vulscan-mcp-debug.log

Report issues on GitHub ā†’

Developer Info

# Clone & run
git clone https://github.com/abhishekrai43/VulScan-MCP.git
cd VulScan-MCP
pip install -r requirements.txt
python -m mcp_server

# Test extension
cd vulscan-mcp-vscode
npm install && npm run compile
# Press F5 in VS Code

License & Support

MIT License | Report Issues

Built with Model Context Protocol, NVD API, OSV API

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Secure Code Review MCP Server

    Balakonda-reddy
    F
    license
    Not graded
    quality
    D
    maintenance
    Local MCP server that scans code for security issues (secrets, dependencies, configurations, risky patterns) and integrates with GitHub Copilot in VS Code for automated pre-commit reviews.
    -

  • VulnPilot

    arojit
    A
    license
    A
    quality
    B
    maintenance
    An MCP server that gives AI assistants the ability to check open-source packages for vulnerabilities, enrich findings with real-world exploit intelligence, and statically analyse whether vulnerable code is actually reachable in your project.
    3
    1
    Apache 2.0

  • GhostFree

    shane-js
    A
    license
    A
    quality
    B
    maintenance
    A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.
    6
    35 npm
    1
    MIT