Vulnicheck
Run Python dependency and vulnerability checks from your agent via HTTP MCP with NVD and GitHub advisory context before you ship.
Overview
Vulnicheck is a MCP server for the Ship phase that exposes Python vulnerability scanning and security analysis over HTTP MCP with NVD and GitHub advisory integrations.
What is this MCP server?
- HTTP streamable MCP at configurable URL (default http://localhost:3000/mcp) via Docker image docker.io/andrasfe/vulniche
- NVD_API_KEY raises NIST rate limits; GITHUB_TOKEN improves GitHub Advisory Database access
- Optional OPENAI_API_KEY or ANTHROPIC_API_KEY for LLM-based risk assessment in MCP passthrough flows
- Comprehensive Python-focused vulnerability scanning and security analysis positioning
- OCI registry distribution—agent connects over HTTP rather than stdio
- Server schema version 0.1.0
- NVD rate limit improves from 5 to 50 requests per 30 seconds with NVD_API_KEY (per server env docs)
- GitHub token documented up to 5000 requests per hour for Advisory Database access
What problem does it solve?
Shipping Python apps without integrated CVE and advisory checks forces context switching and leaves agents unable to run a consistent security scan.
Who is it for?
Builders maintaining Python codebases who want agent-driven security scans tied to NVD and GitHub advisories before release.
Skip if: Non-Python-only stacks, teams without appetite for Docker plus optional LLM keys, or orgs needing certified penetration testing deliverables.
What do I get? / Deliverables
After you run the container and register the HTTP MCP endpoint, your agent can trigger vulnerability scans and richer risk views using your configured API keys.
- Agent-invoked Python security and vulnerability analysis
- Advisory-enriched scan results via configured external APIs
- Optional LLM-assisted risk assessment when API keys are set
Recommended MCP Servers
Journey fit
How it compares
HTTP MCP vulnerability scanner for Python, not a general code linter or infrastructure CSPM product.
Common Questions / FAQ
Who is Vulnicheck for?
Indie developers and small teams shipping Python software who want MCP-accessible vulnerability scanning with national and GitHub advisory feeds.
When should I use Vulnicheck?
Use it in ship and security prep—pre-release, after dependency bumps, or when onboarding an agent to audit a Python repo.
How do I add Vulnicheck to my agent?
Run the vulnicheck Docker image, set MCP_PORT if needed, configure NVD_API_KEY and GITHUB_TOKEN (and optional LLM keys), then add the streamable-http MCP URL to your agent config.