qianniuspace/mcp-security-audit
Free强大的 MCP 服务器，审计 npm 包依赖项的安全漏洞。内置远程 npm 注册表集成，用于实时安全检查。
FreeFree tier
About qianniuspace/mcp-security-audit
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks. It supports multiple severity levels (critical, high, moderate, low), automatic fix recommendations, CVSS scoring, and CVE references. Compatible with npm, pnpm, and yarn package managers. Provides detailed vulnerability reports and can be easily integrated via npx or Smithery.
Key Features
Real-time security vulnerability scanning
Remote npm registry integration
Detailed vulnerability reports with severity levels
Support for multiple severity levels (critical, high, moderate, low)
Compatible with npm/pnpm/yarn package managers
Automatic fix recommendations
CVSS scoring and CVE references
Pros & Cons
Pros
- Real-time vulnerability scanning with up-to-date npm registry data
- Supports multiple package managers (npm, pnpm, yarn)
- Detailed reports including CVSS scores, CVE IDs, and fix recommendations
- Free and open-source
- Easy integration via npx or Smithery for Claude Desktop
Cons
- Limited to npm ecosystem (JavaScript/Node.js only)
- Requires internet connection to remote npm registry
- Only detects known vulnerabilities in the npm registry
- Requires an MCP-compatible client (e.g., Cline, Cursor) for full functionality
Best For
Auditing npm dependencies in Node.js projectsIntegrating security checks into MCP-based tools and IDEs (e.g., Cline, Cursor)Preventing supply chain attacks by detecting vulnerabilities earlyGenerating detailed vulnerability reports for compliance and review
FAQ
How do I install this tool?
You can install via Smithery by running 'npx -y @smithery/cli install @qianniuspace/mcp-security-audit --client claude' or manually by cloning the repo and running 'npm install && npm run build'.
What package managers does it support?
It supports npm, pnpm, and yarn package managers.
What information does the vulnerability report include?
The report includes package name, version, severity level, description, CVE ID, GitHub Advisory ID, fix recommendation, CVSS score, CWE references, and a URL to the advisory.
Can I use this tool with Claude Desktop?
Yes, you can install it for Claude Desktop via Smithery or by manually configuring the MCP server.