VulniCheck MCP Server: AI Vulnerability Scanning for Python

Overview

VulniCheck MCP Server is a Docker-deployable HTTP Model Context Protocol (MCP) service that performs vulnerability and security analysis for Python projects and GitHub repositories. It combines static checks (dependency files, installed packages, Dockerfiles, secrets) with aggregated vulnerability data from multiple sources and optional AI-powered risk assessments via OpenAI or Anthropic APIs. The server exposes a standard HTTP streaming MCP endpoint (no SSE required) so it can integrate with MCP-capable agents and developer tools.

You can run the server locally or in production as a container, scan public or private GitHub repositories (up to ~1 GB), and optionally enable Google OAuth 2.0 for access control. Results include vulnerability metadata, remediation suggestions, secret detection findings, and interactive AI summaries when API keys are provided.

Features

• Docker-based HTTP MCP server with standard HTTP streaming
• Scans dependency manifests (requirements.txt, pyproject.toml, setup.py) and installed packages
• Queries multiple vulnerability databases (OSV.dev, NVD, GitHub Advisory, CIRCL, Safety DB)
• Detects exposed secrets (API keys, passwords, tokens)
• Analyzes Dockerfiles for insecure patterns and vulnerable packages
• GitHub repo scanning (public/private) with commit-level caching
• Optional AI-driven risk assessments via OpenAI / Anthropic
• Optional Google OAuth 2.0 authentication (disabled by default)
• Smart caching to avoid redundant scans and disk-space management with an automatic cleanup limit
• Production-ready HTTP server architecture and configurable rate-limit augmentation (GitHub/NVD tokens)

Installation / Configuration

Pull the official image and run the container:

# pull latest container
docker pull andrasfe/vulnicheck:latest

# run (no AI provider, basic scanning)
docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  andrasfe/vulnicheck:latest

# run with OpenAI for AI-powered assessments
docker run -d --name vulnicheck-mcp -p 3000:3000 \
  --restart=unless-stopped \
  -e OPENAI_API_KEY=your-openai-api-key \
  andrasfe/vulnicheck:latest

Enable additional service tokens to increase API rate limits and features:

# optional environment variables
-e OPENAI_API_KEY=...
-e ANTHROPIC_API_KEY=...
-e GITHUB_TOKEN=...
-e NVD_API_KEY=...

Register the MCP endpoint with an MCP-capable client (example uses Claude CLI):

claude mcp add --transport http vulnicheck http://localhost:3000/mcp

Persistent tokens and OAuth storage

• OAuth tokens (when enabled) are persisted at /home/vulnicheck/.vulnicheck/tokens — use a Docker volume to retain them: -v vulnicheck_tokens:/home/vulnicheck/.vulnicheck/tokens

Google OAuth (optional)

• Provide CLIENT_ID, CLIENT_SECRET and FASTMCP_SERVER_BASE_URL environment variables and start the server in auth mode. Note: OAuth is disabled by default.

Known OAuth compatibility note

• FastMCP 2.12.4 has a known limitation where OAuth endpoints are not correctly mounted for HTTP transport. Local or alternative transport scenarios may work; for production HTTP, validate the OAuth flow for your FastMCP version.

Available Tools

Available endpoints / tool-like RPCs exposed by the MCP server:

Responses are streamed over standard HTTP for incremental results; clients should accept chunked or streaming HTTP responses.

Use Cases

• Continuous security verification in CI:
  • Add a step to your CI pipeline that calls the MCP scan_dependencies or scan_github_repo tool against the current commit, failing builds on high-severity findings.
• Pre-merge vulnerability checks for PRs:
  • Trigger scan_github_repo on pull requests to detect new dependencies or secrets before merge.
• Local developer security checks:
  • Run scan_installed_packages or scan_dependencies locally in a dev container to get quick remediation advice and AI summaries.
• Docker image / Dockerfile hardening:
  • Use scan_dockerfile to identify outdated Python base images, unnecessary root-level installs, and recommendations to reduce attack surface.
• Triage and remediation planning:
  • Use comprehensive_security_check or assess_operation_safety (with AI keys configured) to get prioritized remediation steps and risk context.

Tips & Best Practices

• Configure GITHUB_TOKEN and NVD_API_KEY to increase scanning rate limits for frequent or large repo scans.
• Use a Docker volume for token persistence when enabling OAuth.
• Monitor the container’s storage and adjust the cleanup policy if scanning many large repositories—VulniCheck enforces a default storage cap to prevent disk exhaustion.
• Validate OAuth flows in your environment due to known FastMCP HTTP transport limitations; consider token-based automation where OAuth is incompatible.

Repository and source code: https://github.com/andrasfe/vulnicheck