Server data from the Official MCP Registry
MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.
MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.
Set these up before or after installing:
Environment variable: GHOSTFREE_DIR
Environment variable: GHOSTFREE_MIN_SEVERITY
Environment variable: NVD_API_KEY
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-shane-js-ghostfree": {
"env": {
"NVD_API_KEY": "your-nvd-api-key-here",
"GHOSTFREE_DIR": "your-ghostfree-dir-here",
"GHOSTFREE_MIN_SEVERITY": "your-ghostfree-min-severity-here"
},
"args": [
"-y",
"ghostfree"
],
"command": "npx"
}
}
}This is a well-designed security vulnerability scanner with appropriate permissions for its purpose. The server properly communicates with OSV.dev, NVD, and CISA APIs to scan dependencies for CVEs. No significant security issues found - auth requirements are appropriate, code quality is good, and permissions align with functionality. Supply chain analysis found 23 known vulnerabilities in dependencies (1 critical, 10 high severity). Package verification found 1 issue.
Scanned 5 files · 27 findings
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Be the first to review this server!