MCP Server MCP

GhostFree

By github 👁 1 views ▲ 0 votes

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

Homepage Verified source GitHub

Install

npx -y [email protected]

Configuration Example

{
  "remotes": [],
  "packages": [
    {
      "registryType": "npm",
      "identifier": "ghostfree",
      "version": "0.2.0",
      "runtimeHint": "npx",
      "transport": {
        "type": "stdio"
      },
      "runtimeArguments": [
        {
          "value": "-y",
          "type": "positional"
        }
      ],
      "packageArguments": [
        {
          "description": "Absolute path to the repository to scan for vulnerable dependencies.",
          "isRequired": true,
          "format": "filepath",
          "type": "named",
          "name": "--repo-path"
        }
      ],
      "environmentVariables": [
        {
          "description": "Override the directory where GhostFree stores its data files (accepted-risks.yml, config.yml). Defaults to .ghostfree/ in the scanned repository root.",
          "format": "filepath",
          "name": "GHOSTFREE_DIR"
        },
        {
          "description": "Minimum CVE severity level to surface. One of: CRITICAL, HIGH, MEDIUM (default), LOW.",
          "format": "string",
          "default": "MEDIUM",
          "choices": [
            "CRITICAL",
            "HIGH",
            "MEDIUM",
            "LOW"
          ],
          "name": "GHOSTFREE_MIN_SEVERITY"
        },
        {
          "description": "Optional NVD API key for higher rate limits when enriching CVE details. Free to request at https://nvd.nist.gov/developers/request-an-api-key.",
          "format": "string",
          "isSecret": true,
          "name": "NVD_API_KEY"
        }
      ]
    }
  ]
}

mcp model-context-protocol npm