MCP Security Analyst

@gleicon

代码仓库

基本信息

分类

开发工具

传输方式

stdio

作者

gleicon

关于 MCP Security Analyst

A MCP (Model Context Protocol) server to allow code security reviews using https://osv.dev (Open Source Vulnerabilities Database)

MCP Security Analyst 配置

暂无标准配置

该服务器的 README 中没有可解析的 MCP 配置块，请前往代码仓库查看安装说明。

代码仓库

MCP Security Analyst 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is MCP Security Analyst?

MCP Security Analyst is a Model Context Protocol server that provides comprehensive security analysis through integration with the OSV.dev vulnerability database, native Go-based code analysis, and Gitleaks v8 secret detection. It is designed for developers and AI assistants needing automated security scanning of dependencies, source code, and repositories.

How to use MCP Security Analyst?

Install by running make deps, make build, and make install, or use a pre-built release. Configure the binary /usr/local/bin/mcp-osv as an MCP server in Cursor IDE or Claude Desktop via stdio transport. Invoke the three built-in tools directly through the MCP interface.

Key features of MCP Security Analyst

Supply chain vulnerability analysis via OSV.dev API
Secret detection with 100+ Gitleaks v8 rules
AST-based Go code analysis for security anti-patterns
Regex-based pattern matching for common vulnerabilities
MCP protocol support for AI assistant integration
Community-vetted detection rules for credentials and keys

Use cases of MCP Security Analyst

Check dependency versions for known vulnerabilities
Scan repositories for hardcoded credentials and API keys
Perform comprehensive security audits of code and dependencies
Enable AI assistants to run security analysis via natural language

常见问题

What external services does MCP Security Analyst use?

It queries the OSV.dev vulnerability database for dependency checks and uses the Gitleaks v8 engine for secret detection. Native Go AST analysis runs locally.

What runtime dependencies are required?

Go 1.25.4 or later, plus the Go modules `github.com/mark3labs/mcp-go` and `github.com/zricethezav/gitleaks/v8`.

How are detected secrets displayed?

Secrets longer than 8 characters show the first 4 and last 4 characters with "***" in between. Secrets 8 characters or shorter are fully redacted.

What MCP tools does the server expose?

Three tools: `check_vulnerabilities` (OSV.dev queries), `analyze_security` (combined code analysis, secret detection, and vulnerability check), and `scan_secrets` (dedicated Gitleaks secret scanning with optional git history scan).

Does the server have rate limiting?

Yes, OSV.dev API requests are rate-limited to 1 request per second to prevent throttling.

开发工具分类下的更多 MCP 服务器

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R

Capgo MCP

Cap-go

Console, Backend and CLI to manage Capgo Instant update and Native build for Capacitor apps Build and upload to app store your mobile app

Eased

easedui

Eased is a library of motion-first React components for shadcn, installed with the shadcn CLI.

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

LastPing

Know when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci