Flare MCP server

by flarehq.dev·dev.flarehq/security·v0.2.1

Scan a running app or repo for leaked secrets, exposed routes and open RLS, and verify live keys

C68/100grade C

What users say

No reviews yet

Safety scan

C68/100

Adoption

New

82 downloads/wk

Reviews

Nobody has reviewed Flare yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

flare_authz_test
Detects the top OWASP API risk — objects readable by accounts that do not own them (IDOR), and
flare_scan_repowrite action
Runs Flare's deep source scan over a local directory: committed credentials, .env handling,
flare_scan_urlwrite action
Runs Flare's full external security scan against a URL and returns ranked findings with fixes.
flare_verify_credential
Given a credential you have already found, checks whether it still authenticates by making a

scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it

no findings

Code scan35 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancerepository not readable: repo not found3/15
Maintainer identityverified namespace with website, no repo4/10

Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 68/100; higher than 30% of 915 Security servers
Tools: 4; the typical Security server has 6
Tools that change things: 50%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 82; more than 58% of 248 Security servers with a package

What its tools let an agent do: 2 read · 2 change

Runs npx -y flarehq-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add security -- npx -y flarehq-mcp

Is Flare MCP server safe?: With care: it is graded C, so read the findings first (68/100). Read the Flare safety report
How do I install Flare?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Flare need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Flare maintained?: The latest release is v0.2.1.
What can I use instead of Flare?: Servers from other publishers that do the same job: Secret Scanner MCP server, Secret Scanner MCP server and Inkog MCP server.
How does Flare compare with other Security MCP servers?: safety score 68/100 (higher than 30% of 915 Security servers); tools 4 (the typical Security server has 6); tools that change things 50% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Same job from other publishers: the closest match first, then the best rated.

Secret Scanner
Scans files for leaked secrets and API keys
More from 4hmetuyar →
not reviewed
Growing
A
Secret Scanner
Scans files for leaked secrets and API keys
More from GuardBee →
not reviewed
Growing
A
Inkog
Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
not reviewed
Growing
B
Jikida
Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
not reviewed
Growing
A
Skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
not reviewed
Established
C