Skip to main content
Glama
arojit

VulnPilot

by arojit
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault

No arguments

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
check_packageA

Check an exact dependency version for known vulnerabilities.

Use this tool when the user asks whether a Python, npm, Maven,
or Gradle dependency version is vulnerable.

For Gradle JVM dependencies, use the Maven ecosystem and provide
the package as groupId:artifactId.

Args:
    package_name: Package name, or groupId:artifactId for Maven. Example: django, org.apache.logging.log4j:log4j-core
    version: Exact installed dependency version. Example: 2.2.0, 2.14.1
    ecosystem: One of PyPI, npm, or Maven.
analyze_reachabilityA
Analyze a project to determine whether a package is actually imported.

Statically scans source files for imports of the given package and
classifies each usage as production or test-only. Supports Python
(PyPI), JavaScript/TypeScript (npm), and Java (Maven/Gradle).

Args:
    project_path: Absolute path to the project root directory.
    package_name: Package name to look for. Use groupId:artifactId for Maven/Gradle.
    ecosystem: One of PyPI, npm, Maven, or Gradle. Determines which scanner to use.
    import_names: Override the import name when it differs from the package name
                  (e.g. ["bs4"] for beautifulsoup4, or a Java package prefix).
generate_reportA

Generate a polished HTML security report from scan results.

Accepts aggregated results from check_package and
analyze_reachability, and produces a self-contained HTML
report with executive summary, sortable vulnerability table,
risk gauge, and actionable recommendations.

The report is saved to disk and the path is returned.

Args:
    results: List of PackageReport objects, each combining
        a PackageCheckResult with an optional
        ReachabilityResult.
    project_name: Human-readable project name for the
        report header.
    ecosystem: One of PyPI, npm, Maven, or Gradle.
    output_dir: Directory to save the report into.
        Created if it does not exist.

Prompts

Interactive templates invoked by user choice

NameDescription
security_auditRun a full security audit on a list of project dependencies. Guides the assistant to check every dependency for vulnerabilities and run reachability analysis on the vulnerable ones. Args: project_path: Absolute path to the project root directory. ecosystem: One of PyPI, npm, Maven, or Gradle. dependencies: Comma-separated list of name:version pairs (e.g. "django:4.2.0, requests:2.31.0").
triage_vulnerabilityDeep-dive triage of a single dependency. Walks the assistant through vulnerability lookup, reachability analysis, and a prioritized remediation recommendation. Args: package_name: Package name (e.g. django, lodash, org.apache.logging.log4j:log4j-core). version: Exact version to check (e.g. 2.2.0). ecosystem: One of PyPI, npm, Maven, or Gradle. project_path: Absolute path to the project root directory.
generate_dependency_evidenceGet commands to generate dependency evidence for an ecosystem. Returns the shell commands the user needs to run so that VulnPilot can classify dependencies as direct or transitive. Args: ecosystem: One of PyPI, npm, Maven, or Gradle.

Resources

Contextual data attached and managed by the client

NameDescription
Supported EcosystemsJSON listing of every ecosystem VulnPilot supports, including package name format, available tools, and example coordinates.
Triage Priority RulesExplains the deterministic rules VulnPilot uses to assign IMMEDIATE, URGENT, HIGH, or NORMAL priority to each vulnerability.
Dependency Evidence GuideStep-by-step commands to generate lock files and dependency tree reports so VulnPilot can classify dependencies as direct or transitive.
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clear, distinct purpose: check_package queries vulnerability databases, analyze_reachability scans project imports, and generate_report compiles results into an HTML report. No overlapping functionality.

Naming Consistency5/5

All tool names follow the verb_noun pattern in snake_case (check_package, analyze_reachability, generate_report), ensuring predictability and clarity.

Tool Count5/5

Three tools cover the essential workflow of vulnerability checking, reachability analysis, and report generation. The count is well-scoped for a security scanning server.

Completeness4/5

The toolset covers the core lifecycle: check vulnerabilities, analyze reachability, and generate reports. A minor gap is the lack of a tool to directly retrieve detailed advisory information, but the report tool compensates.

Resources