Vuln Check MCP Server: Install & Setup

Install Vuln Check in Claude Code

npm

Claude Code

claude mcp add vuln-check -- npx -y @ciloops/vuln-check

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "vuln-check": {
      "command": "npx",
      "args": [
        "-y",
        "@ciloops/vuln-check"
      ]
    }
  }
}

Docker

Claude Code

claude mcp add vuln-check -- docker run -i --rm ghcr.io/ciloops/vuln-check:0.1.3

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "vuln-check": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/ciloops/vuln-check:0.1.3"
      ]
    }
  }
}

Frequently asked questions

What does the Vuln Check MCP server do?

Local vulnerability scan on top of grype, with prioritised upgrade actions for agents.

Is the Vuln Check MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does Vuln Check run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Vuln Check to Claude Code?

Run: claude mcp add vuln-check -- npx -y @ciloops/vuln-check

More security & identity MCP servers

View all

Vulnerability Exposure

MRFrazer25/Vulnerability-Exposure-MCP

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

LocalFree

Vaultshell

SoWhatI/vaultshell

Injects secrets into shell commands at exec time; plaintext never reaches the LLM context

LocalFree

Weavatrix Online

1244

Weavatrix/weavatrix-online

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

LocalAccount needed

Universal Host Manager

Abktya/universal-host-manager-mcp

Cross-platform FastMCP server for authenticated remote Linux/macOS host administration

LocalAccount needed

YouTube Shorts Agent

1268

davidmosiah/youtube-shorts-agent

Agent-first YouTube Shorts uploader: dry-run validation, OAuth checks, synthetic-media metadata.

LocalFree

Tremelay

CharitonMedia/Tremelay

Local MCP broker: agents call credentials through a daemon without seeing secrets.

LocalFree