VulnForge MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| vulnforge_audit_webB | Audits web HTTP response headers, cookie flags, and DOM client code for security misconfigurations, XSS sinks, weak CSP, HSTS absences, and tabnabbing. |
| vulnforge_audit_apiB | Audits REST/GraphQL endpoint handlers for Broken Object Level Auth (BOLA/IDOR), unauthenticated mutating endpoints, missing rate limits, and mass assignment risks. |
| vulnforge_audit_dbB | Audits SQL/NoSQL query snippets, ORM commands, and database connection strings for injection vulnerabilities, raw interpolations, and credential leaks. |
| vulnforge_inject_patchB | Synthesizes and automatically injects defensive patches into vulnerable code, converting raw queries to parameterized statements, adding headers, and sanitizing DOM sinks. |
| vulnforge_full_scanC | Runs an end-to-end multi-layer vulnerability audit across Web, API, and DB layers, generating unified findings and ready-to-apply patches. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
The three audit tools are clearly distinguished by layer (web, API, DB), and inject_patch is a distinct action. full_scan overlaps with the combined audits, which could cause minor confusion about when to use it versus individual audits, but its end-to-end purpose is clear.
All tools use snake_case with the vulnforge_ prefix, which is consistent. However, audit_web/audit_api/audit_db and inject_patch follow a verb_noun pattern, while full_scan uses an adjective_noun pattern, a minor deviation.
Five tools is well-scoped for a focused vulnerability auditing/patching server. Each tool targets a specific layer or action and earns its place without redundancy.
The surface covers detection across web, API, and DB layers plus automated patching and a full-scan orchestrator, providing a complete detect-and-remediate cycle. Minor gaps include no dedicated patch verification or scanning beyond these three layers (e.g., dependencies, cloud configs).