CodeVulnerability
CodeVulnerability is a MCP server that provides OWASP-oriented codebase threat scanning for coding agents via remote SSE.
About
CodeVulnerability is a remote MCP server for developers who need OWASP-aligned threat scanning across their application code before shipping to real users. Register the SSE remote in Claude Code, Cursor, Codex, or similar agents so security-focused tool calls can highlight unsafe patterns and leakage risks in the repo you are already iterating on. It belongs in the ship phase and security subphase: run it when features are largely complete and you want an automated appsec lens in addition to manual review and dependency audits. The published description emphasizes auditing codebases for safety leaks; interpret findings as prioritized fix lists you verify and retest locally. Remote premium settlement may use the payment-signature header described in the server manifest. This is an MCP bridge for agent-driven scanning, not a compliance certification or penetration test replacement.
- CodeVulnerability MCP audits codebases for safety leaks with OWASP-oriented threat scanning
- Remote SSE endpoint at codevulnerability-mcp.vercel.app/api/mcp
- Security & Pentesting category fit for pre-release appsec passes
- Premium remote access may require EIP-3009 payment-signature header
- MCP security scanner integration—not a hosted WAF or dependency-only bot
CodeVulnerability by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add --transport sse codevulnerability https://codevulnerability-mcp.vercel.app/api/mcp --header "payment-signature: YOUR_PAYMENT_SIGNATURE"Add your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Transport | SSE |
|---|---|
| Auth | Required |
What it does
Let your agent run OWASP-oriented threat scans on the codebase to catch safety leaks before release.
Who is it for?
Best when you're preparing a first production release and want agent-assisted security passes source tree.
Skip if: Organizations needing formal pentests, compliance sign-off, or air-gapped scanning with no remote MCP.
What you get
After you add CodeVulnerability to your MCP client, your agent can trigger OWASP-style audits and surface safety issues to fix before launch.
- OWASP-oriented threat and safety findings returned through MCP tools
- Prioritized security fix backlog for pre-ship hardening
- Configured CodeVulnerability remote server in your agent setup
By the numbers
- MCP server schema 2025-12-11
- Server version 1.0.0
- Single remote SSE endpoint (codevulnerability-mcp.vercel.app)
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready eviA2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
OWASP-oriented codebase audit MCP, not infrastructure load simulation or catalog structuring.
FAQ
Who is CodeVulnerability for?
Developers and small teams using AI coding agents who need MCP-connected OWASP-style scanning on application code before ship.
When should I use CodeVulnerability?
Use it in the ship phase during security work—after core features are built and before production deploy—to catch safety leaks early.
How do I add CodeVulnerability to my agent?
Install the remote MCP server at https://codevulnerability-mcp.vercel.app/api/mcp with SSE transport and configure the payment-signature secret if premium settlement is required.