The MCP Security Audit Server is a tool for auditing npm package dependencies for security vulnerabilities. With this server, you can:
Scan Node.js dependencies for security vulnerabilities in real-time
Process dependency lists from package.json files
Generate detailed vulnerability reports with severity levels (critical, high, moderate, low), CVSS scores, and CVE references
Receive automatic fix recommendations for vulnerable packages
Connect to remote npm registries for up-to-date security checks
Use with multiple package managers including npm, pnpm, and yarn
Access via API integration through the audit_nodejs_dependencies endpoint
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP Security Audit Server audit my project's dependencies for security issues"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks.
🔍 Real-time security vulnerability scanning
🚀 Remote npm registry integration
📊 Detailed vulnerability reports with severity levels
🛡️ Support for multiple severity levels (critical, high, moderate, low)
📦 Compatible with npm/pnpm/yarn package managers
🔄 Automatic fix recommendations
📋 CVSS scoring and CVE references
To install Security Audit Tool for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install @qianniuspace/mcp-security-audit --client claudeAdd MCP configuration to Cline /Cursor:
{
"mcpServers": {
"mcp-security-audit": {
"command": "npx",
"args": ["-y", "mcp-security-audit"]
}
}
}Clone the repository:
git clone https://github.com/qianniuspace/mcp-security-audit.git
cd mcp-security-auditInstall dependencies and build:
npm install
npm run buildAdd MCP configuration to Cline /Cursor :
{
"mcpServers": {
"mcp-security-audit": {
"command": "npx",
"args": ["-y", "/path/to/mcp-security-audit/build/index.js"]
}
}
}Related MCP server: VibeCheck MCP Server
The tool provides detailed vulnerability information including severity levels, fix recommendations, CVSS scores, and CVE references.
{
"content": [{
"vulnerability": {
"packageName": "lodash",
"version": "4.17.15",
"severity": "high",
"description": "Prototype Pollution in lodash",
"cve": "CVE-2020-8203",
"githubAdvisoryId": "GHSA-p6mc-m468-83gw",
"recommendation": "Upgrade to version 4.17.19 or later",
"fixAvailable": true,
"fixedVersion": "4.17.19",
"cvss": {
"score": 7.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
"cwe": ["CWE-1321"],
"url": "https://github.com/advisories/GHSA-p6mc-m468-83gw"
},
"metadata": {
"timestamp": "2024-04-23T10:00:00.000Z",
"packageManager": "npm"
}
}]
}{
"content": [{
"vulnerability": null,
"metadata": {
"timestamp": "2024-04-23T10:00:00.000Z",
"packageManager": "npm",
"message": "No known vulnerabilities found"
}
}]
}For development reference, check the example response files in the public directory:
Severity-response.json : Example response when vulnerabilities are found (transformed from npm audit API response)
no-Severity-response.json : Example response when no vulnerabilities are found (transformed from npm audit API response)
Note: The example responses shown above are transformed from the raw npm audit API responses to provide a more structured format. The original npm audit API responses contain additional metadata and may have a different structure.
Contributions are welcome! Please read our Contributing Guide for details on our code of conduct and the process for submitting pull requests.
This project is licensed under the MIT License - see the LICENSE file for details.
ESX (qianniuspace@gmail.com)
Audit specific dependencies for vulnerabilities
| Name | Required | Description | Default |
|---|---|---|---|
| dependencies | Yes | Dependencies object from package.json |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It fails to mention whether the operation is read-only, requires network access, or what happens with the dependencies data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence, no unnecessary words. It is concise but slightly under-informative for its brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and minimal description leave the return value and behavior undocumented. The nested object type is not elaborated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the parameter. The tool description adds no additional semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it audits dependencies for vulnerabilities, using a verb-object structure. However, without sibling tools, differentiation is not necessary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use the tool, prerequisites, or alternatives. The description assumes the agent knows the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
With only one tool, there is no possibility of confusion or overlap between tools. The tool's purpose is clearly defined and distinct by default.
A single tool inherently has perfect naming consistency, as there are no other tools to compare it against. The naming follows a clear verb_noun pattern.
A single tool for a server named 'MCP Security Audit Server' feels too thin for the apparent scope. Security auditing typically involves multiple operations (e.g., scanning, reporting, remediation), making one tool insufficient for comprehensive coverage.
The tool surface is severely incomplete for a security audit domain. It only audits Node.js dependencies, missing critical operations like scanning other languages, generating reports, checking configurations, or handling remediation, which are essential for a full security audit workflow.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Dive into the world of npm with our NPM Package Info MCP. Access crucial metadata about any npm
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/qianniuspace/mcp-security-audit'
If you have feedback or need assistance with the MCP directory API, please join our Discord server