GhostFree
by shane-jscommunityv0.2.0
1
GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings, and manage accepted risks.
From the registry: MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.
Install & configure
Install in your client
Paste into the AI you're chatting with — it will figure out the rest
Please install the `ghostfree` MCP server into my current AI client (that's you).
Canonical MCP server config (stdio transport):
- command: `npx`
- args: ["-y","ghostfree","--repo-path","."]
- optional environment variables:
- `NVD_API_KEY`: Optional NVD API key for higher rate limits (example: `<your-nvd-api-key>`)
- `GHOSTFREE_MIN_SEVERITY`: Minimum severity threshold (CRITICAL, HIGH, MEDIUM, LOW) (example: `HIGH`)
- `GHOSTFREE_DIR`: Custom directory for accepted.yml/config.yml instead of .ghostfree/ (example: `.ghostfree`)
Note: Replace the `.` in args with an absolute repo path when configuring for Claude Desktop. Queries OSV.dev, NVD and CISA KEV; no source code leaves your machine.
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.Note: Replace the `.` in args with an absolute repo path when configuring for Claude Desktop. Queries OSV.dev, NVD and CISA KEV; no source code leaves your machine.
Tools (6)
discover_dependencies
Scan repo manifests, return all pinned packages by ecosystem
check_cves
Query OSV.dev for CVEs, filter by severity, apply accepted risks
enrich_cve
Fetch CVSS, CWE, references from NVD + KEV exploitation status
list_accepted_risks
List all accepted risks with expiry status and severity snapshot
accept_risk
Record an accepted risk with reason, expiry date, and severity snapshot
remove_accepted_risk
Remove an accepted risk by UUID
Environment variables
NVD_API_KEYOptional NVD API key for higher rate limitsGHOSTFREE_MIN_SEVERITYOptional — skip the severity prompt and always use this thresholdGHOSTFREE_DIROptional — use a custom directory instead of .ghostfree/Packages
ghostfree
npmv0.2.0transport: stdio
Details
- Language
- TypeScript
- License
- MIT
- Released
- Apr 7, 2026
- Last commit
- Apr 7, 2026
- Registry name
- io.github.shane-js/ghostfree