Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@kr.ai.vdb/vdb Check package 'axios' for vulnerabilities."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-name: kr.ai.vdb/vdb
MCP (Model Context Protocol) server for VDB — the AI-aware vulnerability database. Lets Claude Desktop, Claude Code, Cursor, Cline, Continue, and any MCP client check packages while generating code: known CVEs, slopsquatting (LLM-hallucinated package names an attacker may have registered), CISA KEV status, MCP-server trust profiles, and more.
uvx vdb-mcp # or: pipx run vdb-mcpClaude Desktop (claude_desktop_config.json) / Cursor (.cursor/mcp.json):
{
"mcpServers": {
"vdb": { "command": "uvx", "args": ["vdb-mcp"] }
}
}No install at all — point any streamable-HTTP MCP client at the hosted endpoint:
{
"mcpServers": {
"vdb": { "url": "https://vdb.ai.kr/mcp" }
}
}That's it — the server talks to the hosted instance at https://vdb.ai.kr
by default. Anonymous use gets a free per-IP trial; add an API key for
unmetered access (free at https://vdb.ai.kr/signup):
{
"mcpServers": {
"vdb": {
"command": "uvx",
"args": ["vdb-mcp"],
"env": { "VDB_API_TOKEN": "vdb_..." }
}
}
}Related MCP server: GhostFree
Tool | What it does |
| Check one package (purl + optional version) for vulnerabilities, slop risk, KEV |
| Bulk slopsquatting / risk check for a list of packages |
| Fetch one advisory by ID (CVE-…, GHSA-…, VDB-SLOP-…) |
| Free-text search over the vulnerability corpus |
| Trust tier + permission scopes of a community MCP server |
| Current slopsquatting candidates per ecosystem |
Variable | Default | Meaning |
|
| VDB instance to query (set for self-hosted) |
| (empty) |
|
|
|
|
|
| SSE port |
LLMs hallucinate package names; attackers register them (slopsquatting).
LLMs also happily recommend packages with known RCEs. VDB gives your agent a
guardrail: one tool call before npm install / pip install. See
https://vdb.ai.kr/connect for the one-line prompt variant that needs no MCP
at all.
Elastic License 2.0 — free to use, including inside commercial organizations and CI. The only restrictions: you may not offer this software to third parties as a hosted or managed service, or resell it as a product. Commercial licensing beyond that: dev@egdee.com. API usage is governed by the VDB service terms regardless of how you call it.
This server cannot be deployed
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.