mcp-security-audit

Overview

This MCP server integrates with npm registry to audit package dependencies for security vulnerabilities. It provides real-time scanning with detailed vulnerability reports including severity levels, CVE references, CVSS scores, and fix recommendations. The server supports multiple package managers (npm/pnpm/yarn) and categorizes vulnerabilities by criticality levels.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• audit_package

  Audits npm package dependencies for security vulnerabilities

  Try:Check my package.json for security vulnerabilitiesTry:Scan my node_modules for known security issuesTry:What vulnerabilities are in lodash version 4.17.15?

Note: Tool name inferred from the repository description and functionality, as the README doesn't explicitly list the MCP tool name but describes its security auditing capabilities

Comparable tools

Installation

npx -y @smithery/cli install @qianniuspace/mcp-security-audit --client claude

{
  "mcpServers": {
    "mcp-security-audit": {
      "command": "npx",
      "args": ["-y", "mcp-security-audit"]
    }
  }
}

git clone https://github.com/qianniuspace/mcp-security-audit.git
cd mcp-security-audit
npm install
npm run build

FAQ

What package managers does this MCP server support?

It supports npm, pnpm, and yarn package managers for security auditing.

How are vulnerabilities categorized?

Vulnerabilities are categorized by severity levels: critical, high, moderate, and low, along with CVSS scores for additional context.

Compare mcp-security-audit with