{"name":"io.github.shane-js/ghostfree","slug":"shane-js-ghostfree","title":"GhostFree","description":"MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.","url":"https://mcp.market/server/shane-js-ghostfree","rating":null,"grade":"B","score":72,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":19,"stars":1,"forks":0,"downloads_week":30,"last_push_at":"2026-04-07T01:46:34.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/shane-js/ghostfree","website":"https://github.com/shane-js/ghostfree#readme","version":"0.2.0","remotes":[],"packages":[{"registryType":"npm","identifier":"ghostfree","version":"0.2.0","runtimeHint":"npx","transport":{"type":"stdio"},"runtimeArguments":[{"value":"-y","type":"positional"}],"packageArguments":[{"description":"Absolute path to the repository to scan for vulnerable dependencies.","isRequired":true,"format":"filepath","type":"named","name":"--repo-path"}],"environmentVariables":[{"description":"Override the directory where GhostFree stores its data files (accepted-risks.yml, config.yml). Defaults to .ghostfree/ in the scanned repository root.","format":"filepath","name":"GHOSTFREE_DIR"},{"description":"Minimum CVE severity level to surface. One of: CRITICAL, HIGH, MEDIUM (default), LOW.","format":"string","default":"MEDIUM","choices":["CRITICAL","HIGH","MEDIUM","LOW"],"name":"GHOSTFREE_MIN_SEVERITY"},{"description":"Optional NVD API key for higher rate limits when enriching CVE details. Free to request at https://nvd.nist.gov/developers/request-an-api-key.","format":"string","isSecret":true,"name":"NVD_API_KEY"}]}],"tools":[{"name":"accept_risk","description":"Record an accepted risk for a CVE, with a reason and mandatory expiry date. Expiry beyond 1 year requires confirm_extended_expiry=true.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_cves","description":"Check a list of packages against OSV.dev for known vulnerabilities. Returns CVEs above the severity threshold as a numbered list, suppressed/accepted risks, expired acceptances, and a count of below-threshold findings.","write_action":false,"price_micros":0,"input_schema":null},{"name":"discover_dependencies","description":"Scan the repository for manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, Dockerfiles, etc.) and return all pinned dependencies grouped by ecosystem.","write_action":false,"price_micros":0,"input_schema":null},{"name":"enrich_cve","description":"Fetch enrichment data for a specific CVE ID: CVSS vectors and score from NVD, CWE weakness classification, references, and whether it appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. Gracefully degrades if NVD or KEV are unavailable.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_accepted_risks","description":"List all accepted CVE risks, including whether each acceptance has expired.","write_action":false,"price_micros":0,"input_schema":null},{"name":"remove_accepted_risk","description":"Remove a previously accepted risk by its UUID acceptance ID.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":72,"grade":"B","scanned_at":"2026-09-27T23:16:00.126Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-27T23:16:00.107Z","components":{"code":{"score":25,"max":25,"notes":["2 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":8,"max":15,"notes":["last push 174 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"ghostfree","version":"0.2.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":5,"publishedAt":"2026-04-06T13:01:00.993Z","repositoryUrl":"git+https://github.com/shane-js/ghostfree.git","weeklyDownloads":30}],"repo":{"found":true,"owner":"shane-js","repo":"ghostfree","archived":false,"pushedAt":"2026-04-07T01:46:34Z","stars":1,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/12244245?v=4","ownerCreatedAt":"2015-05-05T01:22:24Z","license":"MIT"},"icon":{"url":"https://raw.githubusercontent.com/shane-js/ghostfree/main/icon.png","source":"registry","width":512,"height":512},"presence":{"stars":1,"forks":0,"downloadsWeek":30,"license":"MIT","lastPushAt":"2026-04-07T01:46:34.000Z","score":19}}}},"grade_history":[],"reviews":[]}