Which integrations are available for this server?

Allows scanning Docker images for vulnerabilities using Trivy and Grype engines. Allows scanning remote Git repositories for vulnerabilities and misconfigurations.

How do I use Security Scanner MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Security Scanner MCP Server cross-validate the alpine:latest image" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Security Scanner MCP Server

by friendlygeorge

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Security Scanner MCP Server

Glama

Multi-engine container & system vulnerability scanning for AI agents. Wraps Trivy and Grype with cross-engine validation, SBOM generation, and IaC misconfiguration scanning.

Why This Exists

Most security MCP servers wrap a single scanner. This one wraps two — Trivy (Aqua Security) and Grype (Anchore) — and runs them against the same target to surface what each engine catches alone. Different vulnerability databases + different detection logic = broader coverage.

Key differentiator: No other MCP server offers multi-engine cross-validation.

Related MCP server: agentguard

Features

15 tools covering vulnerability scanning, SBOM generation, IaC checks, and database management
Cross-engine validation — run Trivy + Grype on the same image and see what each catches alone
MIT licensed — no AGPL encumbrance (unlike @aikidosec/mcp)
npm-native — install via npx, works with Claude Desktop, Cursor, and any MCP client
No cloud account required — runs locally against Docker daemon or filesystem

Quick Start

🚀 New here? See the Quick Start Guide — get scanning in under 5 minutes.

Prerequisites

Install at least one scanning engine:

# Trivy (recommended)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# Grype (for cross-validation)
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

Claude Desktop / Cursor

Add to your MCP configuration:

{
  "mcpServers": {
    "security-scanner": {
      "command": "npx",
      "args": ["-y", "@supernova123/security-scanner-mcp-server"]
    }
  }
}

Standalone

npx @supernova123/security-scanner-mcp-server

Tools

#	Tool	Engine	Description
1	`scan_image`	Trivy	Scan Docker image for vulnerabilities
2	`scan_image_grype`	Grype	Same target via Grype (cross-validation)
3	`vulnerability_report`	Trivy	Detailed report with remediation
4	`scan_filesystem`	Trivy	Local dir/file vulnerability + misconfig scan
5	`scan_filesystem_grype`	Grype	Cross-engine filesystem scan
6	`scan_repository`	Trivy	Remote git repo scan
7	`scan_remote_image`	Grype	Pull from registry directly (no Docker daemon)
8	`scan_purl`	Grype	Single Package URL vulnerability lookup
9	`scan_sbom`	Trivy	Scan SBOM file for vulnerabilities
10	`generate_sbom`	Trivy	Generate CycloneDX/SPDX SBOM
11	`scan_config`	Trivy	IaC misconfiguration scan
12	`cross_validate`	Both	Run both engines, surface divergence
13	`db_status`	Grype	Check vulnerability DB status
14	`update_db`	Grype	Update vulnerability database
15	`get_version`	Both	Engine version + availability

Cross-Validation Example

The cross_validate tool runs both Trivy and Grype on the same Docker image and compares results:

{
  "combined_summary": {
    "total_unique_cves": 47,
    "critical": 2,
    "high": 8,
    "medium": 23,
    "low": 14
  },
  "divergence": {
    "only_in_trivy_count": 5,
    "only_in_grype_count": 3,
    "severity_mismatches": 2,
    "only_in_trivy": ["CVE-2023-1234", ...],
    "only_in_grype": ["CVE-2023-5678", ...]
  },
  "insight": "Cross-validation found 5 CVEs only in Trivy and 3 only in Grype. Using both engines gives broader coverage than either alone."
}

Competitive Landscape

Package	Engine	License	Weekly Downloads
`@aikidosec/mcp`	Cloud API	AGPL-3.0	~11,800
`@paretools/security`	Trivy + Semgrep	MIT	~75
`@supernova123/security-scanner-mcp-server`	Trivy + Grype	MIT	TBD
`aquasecurity/trivy-mcp`	Trivy (Go plugin)	MIT	N/A (not npm)
`anchore/grype-mcp`	Grype (Python)	Apache-2.0	N/A (not npm)

Development

git clone https://github.com/friendlygeorge/security-scanner-mcp-server.git
cd security-scanner-mcp-server
npm install
npm run build
npm test

License

MIT — see LICENSE

Available Tools

15 tools

cross_validateA

Read-only

Scan a Docker image with BOTH Trivy and Grype, then compare results. Surfaces vulnerabilities found by only one engine (different databases = different coverage). This is the key differentiator — no other MCP server offers multi-engine cross-validation.

Inputs: image (required), tag, timeout, severity.

db_statusA

Read-only

Check the status of Grype's vulnerability database — last update time, database schema version, and whether an update is available.

Inputs: no named parameters.

generate_sbomA

Read-only

Generate a Software Bill of Materials (SBOM) for a Docker image in CycloneDX or SPDX format. The SBOM lists all packages and dependencies in the image.

Inputs: image (required), tag, format, output, +1 more.

get_versionA

Read-only

Get version information for installed security scanning engines (Trivy and/or Grype).

Inputs: no named parameters.

scan_configA

Read-only

Scan Infrastructure-as-Code files for misconfigurations and security issues. Supports Terraform, Dockerfile, Kubernetes manifests, CloudFormation, Helm charts, and more.

Inputs: path (required), timeout, scanners, severity.

scan_filesystemA

Read-only

Scan a local directory or file for vulnerabilities, misconfigurations, and secrets using Trivy. Supports Dockerfiles, Terraform, Kubernetes manifests, and application dependencies.

Inputs: path (required), timeout, scanners, severity, +1 more.

scan_filesystem_grypeA

Read-only

Scan a local directory or file for vulnerabilities using Grype. Cross-validates against Trivy filesystem scans.

Inputs: path (required), timeout, severity, only_fixed.

scan_imageA

Read-only

Scan a Docker image for known vulnerabilities using Trivy. Returns a summary of critical/high/medium/low vulnerabilities with package names and fix availability.

Inputs: image (required), tag, timeout, severity, +1 more.

scan_image_grypeA

Read-only

Scan a Docker image for vulnerabilities using Grype (Anchore's scanner). Provides cross-validation against Trivy results — different vulnerability database, different detection coverage.

Inputs: image (required), fail_on, timeout, severity, +1 more.

scan_purlA

Read-only

Look up known vulnerabilities for a specific package using its Package URL (PURL). Useful for checking if a specific dependency version is affected by any CVEs.

Inputs: purl (required), severity.

scan_remote_imageA

Read-only

Scan a container image directly from a remote registry using Grype. No Docker daemon required — pulls the image manifest and layers directly.

Inputs: image (required), timeout, platform, severity.

scan_repositoryB

Read-only

Scan a git repository (local or remote URL) for vulnerabilities, misconfigurations, and secrets using Trivy.

Inputs: url (required), branch, timeout, scanners, +1 more.

scan_sbomA

Read-only

Scan a Software Bill of Materials (SBOM) file for known vulnerabilities. Accepts CycloneDX or SPDX format SBOMs.

Inputs: sbom_path (required), timeout, severity.

update_dbA

Update Grype's vulnerability database to the latest version. Recommended before scanning if the DB hasn't been updated recently.

Inputs: no named parameters.

vulnerability_reportA

Read-only

Generate a detailed vulnerability report for a Docker image with remediation recommendations (which packages to upgrade). More detailed than scan_image.

Inputs: image (required), tag, timeout, severity.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.8/5.0

Scored 2026-07-05 13:05 across 15 tools

Disambiguation4/5

Most tools have clearly distinct purposes: scanning different targets (image, filesystem, repository, SBOM, PURL) and using different engines (Trivy, Grype, cross-validation). However, `scan_image` and `vulnerability_report` both scan Docker images with overlapping vulnerability output, and `db_status`/`update_db` are closely related, causing minor ambiguity.

Naming Consistency4/5

The majority of tools follow a `verb_noun` pattern (e.g., `scan_image`, `generate_sbom`), with consistent use of the `scan_` prefix for scanning tools. However, `vulnerability_report` is a noun phrase, `cross_validate` is a verb without an object, and `db_status` is noun_noun, breaking the pattern slightly.

Tool Count5/5

15 tools is well within the ideal 3-15 range, covering scanning, SBOM generation, database management, and reporting. Each tool serves a distinct purpose without being too numerous or too sparse for a security scanner server.

Completeness4/5

The tool set covers core security scanning operations for Docker images, filesystems, repositories, IaC configs, and SBOMs, with multi-engine support and cross-validation. Minor gaps include lack of running container scanning or direct CVE lookups beyond PURL, but the surface is largely complete for the domain.

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

SafeWeave
dev.safeweave
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Code Analysis Penetration Testing Security
16
https://mcp.safeweave.dev/mcp
Security Intel MCPA
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
https://security.selflabbs.com/mcp
Security Intel MCPA
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp
DepScoutA
io.github.yc-droid
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
Security Penetration Testing Developer Tools
41
https://depscout.salesup.workers.dev/mcp

Related MCP Servers

SAST MCP Server
Security Code Analysis CI/CD & DevOps
Skyrxin
A
license
A
quality
C
maintenance
Enables AI agents to scan code for security vulnerabilities using multiple static analysis tools, with support for filtering, deduplication, and CI/CD integration.
Updated 4 months ago (2026-06-29 14:08 UTC)
27
44 PyPI
4
MIT
agentguard
Security Code Analysis AI & Machine Learning
shuaicongxiaomai
A
license
Not graded
quality
C
maintenance
Provides security checks for AI agents, including secret scanning, CVE lookup, and dependency vulnerability scanning, all running locally except for CVE lookups.
Updated 4 months ago (2026-07-02 10:56 UTC)
MIT
EthosSecurity
Penetration Testing Code Analysis Security
maiconpl2
F
license
Not graded
quality
B
maintenance
Enables users to run AI-assisted security reviews across bug hunting, application security, and infrastructure security by orchestrating tools such as Semgrep, CodeQL, Trivy, Gitleaks, OSV-Scanner, and OWASP ZAP. It produces local JSON and HTML reports with findings, evidence, and unperformed check status for further investigation.
Updated a month ago (2026-10-05 20:25 UTC)
3
-
vuln-check
Penetration Testing Security Developer Tools
ciloops
A
license
Not graded
quality
B
maintenance
Enables AI agents to scan directories, container images, and SBOMs for vulnerabilities, look up individual CVEs, and refresh the local vulnerability database. Findings come back prioritized with concrete upgrade targets rather than raw scanner output.
Updated 21 days ago (2026-10-23 16:17 UTC)
1
Apache 2.0

Security Scanner MCP Server

Why This Exists

Features

Quick Start

Prerequisites

Claude Desktop / Cursor

Standalone

Tools

Cross-Validation Example

Competitive Landscape

Development

License

Links

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

SAST MCP Server

agentguard

EthosSecurity

vuln-check