Closeread Verify MCP server

closeread-verify

A verified dependency-audit verdict any AI agent can call.

<!-- mcp-name: io.github.FreeGuy-AI/closeread-verify -->

A free scanner gives you raw CVEs. closeread-verify gives you the judgment: the verdict checked against the version you actually installed, the one finding that matters, and the exact fix. It runs as an MCP server, so any agent (Claude Code, Cursor, your own) can call it before it ships code and get back a checked answer, not a wall of noise.

Why this and not npm audit

A raw scanner and the agent itself can already produce a list of CVEs. What they cannot manufacture is the verdict. closeread-verify is built around the one discipline that separates a real audit from a scan:

manifest is not what you shipped. The tool resolves the real pinned version from your lockfile and checks that, so it does not cry wolf over a caret range you already patched, and does not miss a vulnerable pin a manifest-only scan would wave through.

• It reports the INSTALLED version, not the declared floor. ^4.17.0 in a

to bump) is separated from the one you inherited five levels down. Most scanners flatten these into one undifferentiated list. This one tells you which is which.

• It splits direct vs transitive. The dependency you declared and own (yours

single lead: the highest-severity direct production issue, with the exact fix. If the only findings are transitive or dev-only, the lead is honestly null rather than a manufactured headline.

• It surfaces the one finding that matters. Instead of 200 rows, you get a

same verdict out. Advisories are confirmed against OSV.dev. The verdict carries its own basis so a reviewer can re-run it.

• It is deterministic and re-checkable. No LLM in the path. Same lockfile in,

That verified artifact, not the raw scan, is the product.

Install

pip install closeread-verify

Python 3.11+. No API key, no account, no source access. Lockfile in, verdict out.

See it in an agent loop

examples/agent_loop.py is a runnable agent that uses closeread-verify as a pre-ship gate: it blocks on a real Flask CVE, applies the named fix, re-checks, and ships. Real MCP over stdio, real OSV advisories, no API key.

python examples/agent_loop.py

Use it as an MCP server

closeread-verify is the stdio command that starts the server:

closeread-verify

Client config

Add it to your MCP client. Claude Code / Cursor style (mcp.json / claudedesktopconfig.json):

{
  "mcpServers": {
    "closeread-verify": {
      "command": "closeread-verify"
    }
  }
}

If you installed into a specific environment, point at that interpreter instead:

{
  "mcpServers": {
    "closeread-verify": {
      "command": "python",
      "args": ["-m", "closeread.mcp_server"]
    }
  }
}

The three tools

Shortened. The full README is on GitHub.