Keep Me Secure MCP Server

keep-me-secure-mcp

Ask your coding agent "Is my stack secure?" and get a yes or no, with what to do next.

Website · Changelog · Contributing · Security · MIT license

It's a free, open source MCP server. It checks every package in your lockfiles against public security advisories, including the ones you didn't install directly.

Why not just Dependabot?

Keep using it: it's great at opening fix pull requests, and this can set it up for you. Keep Me Secure adds flaws in Node.js and PHP themselves, support end dates, platform breaches and OS packages in Dockerfiles, and it answers in your coding session, on your working copy.

Quick start

Add it to Claude Code. You need Node.js 22 or newer, and no account or Docker.

claude plugin install keep-me-secure --marketplace robertkeus/keep-me-secure-mcp

Now it checks by itself when you start coding, once a day per project. You can also ask your agent at any time:

Is my stack secure?

It never changes anything without your OK.

Ways to use it

Docker

Run this in your project:

docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/workspace" ghcr.io/robertkeus/keep-me-secure-mcp:latest init

This adds or updates three files:

The config pins the image version, so a new release never reaches your project unannounced. Run the command again to upgrade.

For other agents, keep the AGENTS.md rule: in testing, Codex only called the tool when that rule was present.

In ~/.codex/config.toml:

[mcp_servers.keep-me-secure]
command = "sh"
args = ["-c", "exec docker run -i --rm --read-only --cap-drop=ALL --security-opt=no-new-privileges -v \"$PWD:/workspace:ro\" -v kms-cache:/cache ghcr.io/robertkeus/keep-me-secure-mcp:latest"]

In opencode.json:

{
  "mcp": {
    "keep-me-secure": {
      "type": "local",
      "command": ["sh", "-c", "exec docker run -i --rm --read-only --cap-drop=ALL --security-opt=no-new-privileges -v \"$PWD:/workspace:ro\" -v kms-cache:/cache ghcr.io/robertkeus/keep-me-secure-mcp:latest"],
      "enabled": true
    }
  }
}

Tested with Claude Code, Codex and opencode. Cursor and other MCP clients should work with the same command, but haven't been tested. The agent must start in your project folder, because $PWD is what gets scanned.

Hosted URL

Add https://mcp.keepmesecure.dev/mcp as a remote MCP server in your agent. No account or token is needed, and each IP address gets 20 checks per minute.

• Your agent reads your lockfiles and sends package names and versions, so coverage depends on your agent. In one test it sent only 19 of 39 packages. Use the plugin or Docker when coverage matters.
• Your agent is told to leave out private packages, but that isn't enforced. If your package names are sensitive, run it locally.
• The server doesn't log or store package lists, and Worker logging is turned off. Package names and versions are passed to OSV, and Cloudflare may keep its own standard request data.
• Every package is treated as a direct dependency, so check the suggested command for transitive ones.

What it checks

Lockfiles in test and example folders (such as test, spec, fixtures and examples) are skipped, because they usually don't ship. They're listed in coverage.ignored, and check_project still checks one if you name it with path.

Maven has no lockfile, so pom.xml projects return unknown. So do Gradle and .NET projects with locking turned off.

Node.js and PHP versions

Flaws in the runtime itself don't appear in your lockfile. In October 2026, Node.js and PHP both shipped fixes for flaws that CISA lists as exploited. So Keep Me Secure also reads the versions your project declares:

• affected: that version has the flaw, or its release line got no fix. The session-start message mentions these.
• unverified: the repo only shows a range or a floating tag such as php:8.5, so the patch version can't be read. These appear in check_project, not the session-start message.
• Declared versions may not be what runs on your servers, so check those too. check_runtime takes an exact version, for example from php --version.
• Advisories are a curated list from each project's own security pages, updated through a daily feed. They're reported separately and don't change the package verdict.

Staying ahead

These don't change the yes or no, but they show up in check_project.

• Support dates: for each declared Node.js or PHP version, it shows when active support and security fixes end, and whether it's an LTS line. End of life and ending within 180 days also appear in the session-start message. Dates come from endoflife.date.
• Release age: it checks whether npm, pnpm, Yarn and Composer wait before installing new releases, and shows the setting to add. Waiting about 2 days blocks many supply chain attacks, but it also delays security fixes, so results with urgency now show how to let that one fix through.
• Old packages: it flags direct dependencies that are deprecated, abandoned, or have had no release for two years. Old doesn't mean unsafe, so this is only a prompt to look. It uses deps.dev and Packagist. The session-start hook skips it, but it runs whenever your agent calls check_project, which it may do when a session starts.

Dockerfiles

It reads each Dockerfile or Containerfile for the base image and its OS, end-of-life OS versions, floating tags such as latest, whether the image runs as root, and OS packages installed with apk or apt.

A Dockerfile doesn't show exact package versions or what's really running, so anything it finds is unverified. To be sure, scan the built image with a tool such as Trivy or Grype. System advisories are a curated list, starting with the OpenSSH password bypass on Alpine.

Dependabot

Ask your agent to set it up. suggest_dependabot returns a .github/dependabot.yml for your package managers and Dockerfiles, and your agent writes it with your OK. It uses a 2 day cooldown, which makes routine updates wait. GitHub doesn't apply cooldowns to security updates, so fixes aren't delayed.

Platform breaches

Packages aren't the only risk. In October 2026 alone, several developer and AI platforms disclosed incidents where customer secrets may have been exposed. If your project uses one, Keep Me Secure tells you what happened and what to do, with a link to the source.

• Detection: it looks for files such as railway.toml, vercel.json, zbpack.json and trigger.config.ts, and for packages such as @trigger.dev/sdk. Platforms that leave no trace in a repo aren't detected, so ask your agent, for example "Was Northflank breached?".
• The list: no public database of platform incidents exists, so we keep a curated list, taken from what each company has said. It isn't complete, so an empty result doesn't mean a platform is safe.
• Updates: the plugin and Docker versions fetch the list once a day, which sends nothing about your project. The feed can only add incidents: the ones shipped with each release always stay, and every entry is validated. It isn't signed yet.
• Reporting: the session-start message mentions incidents from the last 90 days. check_platform always shows all of them. Platform incidents are reported separately and don't change the package verdict.

To add an incident, open a pull request that edits src/platforms.ts and links the company's own statement.

Tools

Example result, shortened:

{
  "verdict": "yes",
  "urgency": "today",
  "findings": [{
    "package": "guzzlehttp/guzzle",
    "installed": "7.4.0",
    "fixed_in": "7.15.2",
    "direct": true,
    "severity": "HIGH",
    "exploited": false,
    "advice": "Upgrade guzzlehttp/guzzle to 7.15.2 or later.",
    "command": "composer update guzzlehttp/guzzle --with-dependencies"
  }],
  "coverage": { "scanned": 2, "by_ecosystem": { "Packagist": 2 }, "private": ["acme/internal"], "unchecked": [] }
}

Verdicts

• yes: at least one installed version has a known advisory.
• no: every package was checked and none has a known advisory.
• unknown: the check was incomplete, for example a missing lockfile, an unsupported ecosystem or a failed lookup. coverage.unchecked says why. Don't read this as safe.

Urgency

• now: a malicious package, or a vulnerability in the CISA KEV list of actively exploited issues.
• today: critical, high or unrated severity.
• this_week: everything else.

For malicious packages, upgrading isn't enough. The advice is to remove the package, rotate secrets and check for changes it may have made.

Data and privacy

The full statement is at keepmesecure.dev/privacy. This project is provided as is and used at your own risk, as set out in the terms.

• Names of direct dependencies are sent to deps.dev and Packagist whenever your agent calls check_project, which it may do when a session starts.
• Names and versions of public packages are sent to OSV.dev. When something is affected, CVE ids go to FIRST EPSS. The CISA KEV feed is downloaded.
• Packages from private registries, git or local paths are not sent anywhere. They're listed in coverage.private and aren't checked.
• Go, Java, .NET, requirements.txt, most pnpm and some Yarn lockfiles don't show which registry a package came from, so private package names in those can be sent to OSV, deps.dev and Packagist. Local replace paths in go.mod are the exception.
• Results are cached per day, in ~/.cache/keep-me-secure for the plugin and the kms-cache volume for Docker. A lockfile change triggers a new check.

Security

• The Docker container gets your project read-only, runs as a non-root user with a read-only filesystem and no capabilities.
• It never installs or upgrades anything. The agent proposes a command and you approve it.
• Images are published with provenance and an SBOM.
• Anything that reaches your agent is treated as untrusted. Package names, versions and advisory ids must match strict patterns, file paths and lockfile text are reduced to safe characters, and advisory text is shortened, flattened and labelled summary_untrusted. That last field is still third-party text, so agents are told to treat it as data.

To report a vulnerability, see SECURITY.md.

Limits

• It covers third-party packages, plus curated lists of runtime flaws, platform incidents and OS package flaws in Dockerfiles. It doesn't scan built images, your servers, software on your computer, or your own code. A no doesn't mean your whole stack is secure.
• A no means no known issue at checked_at. OSV can lag behind an incident by a few hours.
• It doesn't check whether your code actually reaches the vulnerable function.
• For a transitive dependency, the fix may have to come from upgrading its parent package.

Self-hosting

You can run the HTTP server yourself:

docker run --rm -p 8080:8080 --read-only --cap-drop=ALL -v kms-cache:/cache ghcr.io/robertkeus/keep-me-secure-mcp:latest serve

The endpoint is /mcp, and /health is for health checks. Rate limits are kept in memory, per instance. Set PORT to change the port. Set KMS_TRUST_PROXY=1 only behind a proxy that adds X-Forwarded-For, so rate limits apply to the real client.

Contributing

See CONTRIBUTING.md. This project is MIT licensed.

Development

docker compose build

docker compose run --rm test

docker compose run --rm -e LIVE=1 test

To try it on a vulnerable project:

PROJECT_DIR=./test/fixtures/php docker compose run --rm -T mcp check

To run the Cloudflare Worker locally:

npx wrangler dev

Pushing a v* tag publishes the image to GHCR.