MCP.Market

Vulnify MCP server

online · 100% uptime
by vulnify.io·io.vulnify/mcp·v0.1.4·2 stars
No reviews yet

Ask Vulnify before an AI agent acts. Check, record, and read policy decisions.

A100/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A100/100

full report

Adoption
Growing

2 stars921 downloads/wk

Reviews

Write one

Nobody has reviewed Vulnify yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Vulnify tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Public scan report

scanner v0.1.10 · 2026-10-12 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • Live reliabilityremote reachable in 137ms (auth required)20/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualityOAuth resource metadata advertised on 40115/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year; website matches verified namespace10/10
Overall 100/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Vulnify compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
100/100
higher than 100% of 4,460 AI and agents servers
Uptime
100%
of our recent checks; the typical remote AI and agents server answers 100%
Response time
339 ms
faster than 41% of 2,331 AI and agents servers
GitHub stars
2
more than 65% of 2,711 AI and agents servers
Downloads a week
921
more than 92% of 1,538 AI and agents servers with a package

Install Vulnify in Claude Code, Cursor or VS Code

claude mcp add --transport http mcp https://mcp.vulnify.io/mcp
Add to Cursor

What the publisher says

From the Vulnify repository's README, as published. We do not edit it. Read it on GitHub

Vulnify MCP

Ask Vulnify before an AI agent reads, writes, deletes, exports, or sends data. finalDecision is the authoritative result: ALLOW, REVIEW, or BLOCK.

Docs  ·  MCP  ·  Changelog  ·  Node SDK

@vulnify/mcp is the MCP server for Vulnify, a runtime authorization layer for AI agents. The agent asks first. This process proxies https://api.vulnify.io. It does not store events or API keys.

Sign in with Vulnify (OAuth 2.1) at https://mcp.vulnify.io/mcp. That hosted server speaks stateless Streamable HTTP. The local path is npx -y @vulnify/mcp with VULNIFYAPIKEY.

checkaction is a dry run. It skips the PII scan and records nothing. decideaction records a real decision. A REVIEW waits for a person. This server cannot approve or deny one.

Application code that should decide inside your own process uses the Node SDK (@vulnify/sdk). This package does not depend on the SDK. The SDK turns some transport failures into a fail-closed decision. This server returns those failures as MCP tool errors, so a model does not read them as ALLOW.

Quickstart

The source of truth is docs.vulnify.io/mcp. The same steps are in docs/clients.md.

Sign in with Vulnify

Connect to https://mcp.vulnify.io/mcp. Leave API-key and OAuth client fields empty. The client receives HTTP 401 and:

WWW-Authenticate: Bearer realm="https://mcp.vulnify.io/mcp", resource_metadata="https://mcp.vulnify.io/.well-known/oauth-protected-resource/mcp", scope="decisions:read decisions:write policies:read policies:test"

The body is {"error":"unauthorized","message":"Sign in with Vulnify, or send an API key as Authorization: Bearer or X-Vulnify-Key:."}. Protected-resource metadata lists the authorization server https://api.vulnify.io.

You choose an organization and allow the scopes the client requests:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Vulnify: common questions

Is Vulnify MCP server safe?
Yes, by our scan: it is graded A (100/100). Read the Vulnify safety report
How do I install Vulnify?
It runs remotely at mcp.vulnify.io. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Vulnify need an API key?
No key to paste: it signs you in with OAuth when your client connects.
Is Vulnify maintained?
The last commit was 24 days ago (2026-10-10). The latest release is v0.1.4.
Is Vulnify up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
What can I use instead of Vulnify?
Servers from other publishers that do the same job: CHAP Coordinator MCP server, Decionis MCP server and Mockserver MCP server.
How does Vulnify compare with other AI and agents MCP servers?
safety score 100/100 (higher than 100% of 4,460 AI and agents servers); uptime 100% (of our recent checks; the typical remote AI and agents server answers 100%); response time 339 ms (faster than 41% of 2,331 AI and agents servers). Full comparison.

Alternatives to Vulnify

Same job from other publishers: the closest match first, then the best rated.

  • CHAP Coordinator
    Auditable records of human decisions over AI agent work. Approvals, edits, overrides, escalations.
    A
  • Decionis
    Authorize consequential AI agent actions before execution
    A
  • Mockserver
    Mock, record/replay, verify and chaos-test any HTTP, REST, gRPC or LLM dependency over MCP.
    A
  • Kiln
    Spawn an object into existence: describe it, and your agent designs it, checks it, and 3D prints it.
    B
  • three.ws Provenance
    Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
    B