Security Scanner MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_imageA | Scan a Docker image for known vulnerabilities using Trivy. Returns a summary of critical/high/medium/low vulnerabilities with package names and fix availability. |
| vulnerability_reportA | Generate a detailed vulnerability report for a Docker image with remediation recommendations (which packages to upgrade). More detailed than scan_image. |
| scan_filesystemA | Scan a local directory or file for vulnerabilities, misconfigurations, and secrets using Trivy. Supports Dockerfiles, Terraform, Kubernetes manifests, and application dependencies. |
| scan_repositoryB | Scan a git repository (local or remote URL) for vulnerabilities, misconfigurations, and secrets using Trivy. |
| scan_sbomA | Scan a Software Bill of Materials (SBOM) file for known vulnerabilities. Accepts CycloneDX or SPDX format SBOMs. |
| generate_sbomA | Generate a Software Bill of Materials (SBOM) for a Docker image in CycloneDX or SPDX format. The SBOM lists all packages and dependencies in the image. |
| scan_configA | Scan Infrastructure-as-Code files for misconfigurations and security issues. Supports Terraform, Dockerfile, Kubernetes manifests, CloudFormation, Helm charts, and more. |
| scan_image_grypeA | Scan a Docker image for vulnerabilities using Grype (Anchore's scanner). Provides cross-validation against Trivy results — different vulnerability database, different detection coverage. |
| scan_filesystem_grypeA | Scan a local directory or file for vulnerabilities using Grype. Cross-validates against Trivy filesystem scans. |
| scan_remote_imageA | Scan a container image directly from a remote registry using Grype. No Docker daemon required — pulls the image manifest and layers directly. |
| scan_purlA | Look up known vulnerabilities for a specific package using its Package URL (PURL). Useful for checking if a specific dependency version is affected by any CVEs. |
| db_statusA | Check the status of Grype's vulnerability database — last update time, database schema version, and whether an update is available. |
| update_dbA | Update Grype's vulnerability database to the latest version. Recommended before scanning if the DB hasn't been updated recently. |
| get_versionA | Get version information for installed security scanning engines (Trivy and/or Grype). |
| cross_validateA | Scan a Docker image with BOTH Trivy and Grype, then compare results. Surfaces vulnerabilities found by only one engine (different databases = different coverage). This is the key differentiator — no other MCP server offers multi-engine cross-validation. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 15 tools
Most tools have clearly distinct purposes: scanning different targets (image, filesystem, repository, SBOM, PURL) and using different engines (Trivy, Grype, cross-validation). However, `scan_image` and `vulnerability_report` both scan Docker images with overlapping vulnerability output, and `db_status`/`update_db` are closely related, causing minor ambiguity.
The majority of tools follow a `verb_noun` pattern (e.g., `scan_image`, `generate_sbom`), with consistent use of the `scan_` prefix for scanning tools. However, `vulnerability_report` is a noun phrase, `cross_validate` is a verb without an object, and `db_status` is noun_noun, breaking the pattern slightly.
15 tools is well within the ideal 3-15 range, covering scanning, SBOM generation, database management, and reporting. Each tool serves a distinct purpose without being too numerous or too sparse for a security scanner server.
The tool set covers core security scanning operations for Docker images, filesystems, repositories, IaC configs, and SBOMs, with multi-engine support and cross-validation. Minor gaps include lack of running container scanning or direct CVE lookups beyond PURL, but the surface is largely complete for the domain.