Vulnerability Scanner runs on your own machine — the client starts it, so there is no endpoint to ping. 43 installs a week from npm. Last commit 11 Oct 2026.
Triggers GuardBee scans, queries findings, AI-assisted remediation guidance
What the code does
We read the source, 5 h ago · rules ccca72095570
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const result = spawnSync(process.execPath, [cliPath, entry.cmd, ...args], {
pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add vulnerability-scanner -- npx -y @guardbee/mcp-vulnerability-scanner{
"mcpServers": {
"vulnerability-scanner": {
"args": [
"-y",
"@guardbee/mcp-vulnerability-scanner"
],
"command": "npx"
}
}
}[mcp_servers.vulnerability-scanner]
command = "npx"
args = ["-y", "@guardbee/mcp-vulnerability-scanner"]{
"mcpServers": {
"vulnerability-scanner": {
"args": [
"-y",
"@guardbee/mcp-vulnerability-scanner"
],
"command": "npx"
}
}
}{
"mcpServers": {
"vulnerability-scanner": {
"args": [
"-y",
"@guardbee/mcp-vulnerability-scanner"
],
"command": "npx"
}
}
}Alternatives to Vulnerability Scanner
same job, measured the same wayValidated API and app vulnerability findings with remediation guidance.
Register/verify your domains, queue security scans, and read findings (CVE, severity).
CISA advisories & ICS alerts: new CVEs, remediation. Register in-session — free testnet funds.
Guarded AI mobile Appium testing, security scanning, verification, and fix-retest MCP tools.
CTEM for your Trusteed tenant: security summary, findings, compliance gaps, and scans via OAuth.
Guidance for answering vendor security questionnaires. Every result carries the page it came from.
Trigger security scans and read reports/vulnerabilities via the hosted Scannd API. Free: 2 scans/mo.
Apiiro Application Security Posture Management (ASPM) tools for AI coding assistants.
Vulnerability Scanner — questions
Answers built from our own checks of this server.