Inkog
Audit MCP servers and agent configs for vulnerabilities before you wire them into Claude Code or Cursor.
Overview
Inkog is a Ship-phase MCP server that scans AI agents and MCP servers for security vulnerabilities before you install them.
What is this MCP server?
- Scans AI agents and MCP server definitions for known security weaknesses
- Designed for audit-before-install workflow on third-party MCP packages
- stdio npm package @inkog-io/mcp (v1.0.5) with INKOG_API_KEY auth
- Free tier available at app.inkog.io for solo builders testing new servers
- Complements manual README review with automated vulnerability signals
- Server schema version 1.0.5
- stdio transport via npm package @inkog-io/mcp
- Requires secret INKOG_API_KEY (free tier noted in registry metadata)
Community signal: 2 GitHub stars.
What problem does it solve?
You cannot safely trust every MCP listing without a fast, agent-driven security check before it gets API keys and shell access.
Who is it for?
Indie builders who add new MCP servers weekly and want a repeatable pre-install security pass from inside the agent.
Skip if: Teams that only use first-party, internally authored MCP servers with no third-party registry risk.
What do I get? / Deliverables
You get vulnerability-oriented scan results on agents and MCP packages so you can reject or harden integrations before registration.
- Security scan output for target agents or MCP server definitions
- Documented risk context to support install or block decisions
Recommended MCP Servers
Journey fit
How it compares
MCP-backed security scanner, not a general code-review or SAST skill inside the repo.
Common Questions / FAQ
Who is Inkog MCP for?
Solo and small teams shipping with coding agents who install third-party MCP servers and want automated vulnerability checks before connect.
When should I use Inkog MCP?
Use it during Ship security review whenever you evaluate a new MCP server, agent plugin bundle, or after upgrading an existing MCP package.
How do I add Inkog MCP to my agent?
Install @inkog-io/mcp from npm, set INKOG_API_KEY from https://app.inkog.io, and register the stdio server in Claude Code, Cursor, or Codex MCP settings.