Vdb MCP Server

by ai-vdb Your server? Claim it

answering

Vdb is answering right now. Last checked 9 min ago. 215 installs a week from pypi. It exposes 7 tools. Last commit 27 Oct 2026.

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

Installs per day peak 592 · avg 57 · -76% w/w

a month agotoday

Uptime history 37 days of history · worst day 98%

37 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

1028 ms

Response time

average over 24h

215

Installs / week

npm and PyPI

What changed 3

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 27 October 2026. No other catalogue keeps this.

28 Oct a tool changed version2 times that day

27 Oct a tool changed version

and 1 more, back to 27 October 2026

What the code does

We read the source, 3 d ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

File ships in the package but is absent from the source [пакет] sync.sh:1, [пакет] vendor-harden.sh:1

этот файл ставится пользователю, но в репозитории его нет

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add vdb --transport http https://vdb.ai.kr/mcp

Settings → Connectors → Add custom connector, then paste this address

https://vdb.ai.kr/mcp

~/.codex/config.toml

[mcp_servers.vdb]
url = "https://vdb.ai.kr/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "vdb": {
      "url": "https://vdb.ai.kr/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "vdb": {
      "type": "http",
      "url": "https://vdb.ai.kr/mcp"
    }
  }
}

Available tools 7

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

vdb

vdb_check_mcp_server

BEFORE recommending a community/unofficial MCP server, check it here. Scope risk is evaluated independently of advisory risk — an unvetted publisher asking for shell or filesystem access is refused even with a clean record. Follow the returned `agent_action`.

vdb_check_package

BEFORE recommending or installing any package, check it here. The response carries `agent_action`: REFUSE (do not add it — relay the `because` text to the user), CONFIRM (ask the user first), or PROCEED. A failed or rate-limited call also answers REFUSE; never proceed unchecked. Also returns the underlying advisories, slop risk, and KEV status as supporting data.

vdb_check_packages

Bulk-check several packages in one call — always prefer this over repeated vdb_check_package. Each result carries its own `agent_action` (REFUSE / CONFIRM / PROCEED) plus a top-level `agent_action` for the batch. Follow them; relay `because` when refusing. Send names EXACTLY as written — do not correct a typo first, the call is the typo test.

vdb_list_slopsquatting

List packages currently flagged as slopsquatting candidates in a given ecosystem.

vdb_lookup

Fetch a single vulnerability by ID or alias (e.g. CVE-2024-1234, GHSA-xxxx-yyyy-zzzz, VDB-SLOP-…).

vdb_scan_lockfile

BEFORE merging, scan the resolved lockfile. Checking the packages someone chose misses the transitive ones nobody did — which is usually where the risk is. Pass the file contents (package-lock.json, requirements.txt, uv.lock, go.sum, Cargo.lock, a CycloneDX SBOM, …). Returns `agent_action`: REFUSE means do not merge.

vdb_search

Free-text search over the VDB vulnerability corpus.

Endpoints

URL	Transport	State	Latency	Checked
https://vdb.ai.kr/mcp	streamable-http	answering	510 ms	9 min ago

Alternatives to Vdb

same job, measured the same way

Pkgtruth

by hxckya

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

69 installs/wk local only

Repomagpie

by varshavia

Your agent checks your notes before installing and stops on packages you or your team ruled out.

746 installs/wk local only

SkillTriage

by moorai

Scan AI agent skills, MCP server packages and MCP configs before you install them. Static analysis.

4 tools answering

lurq

by jadenryu

Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift.

16 tools answering

alalanet — check before you pay

by alalanet

Check packages, MCP servers and x402 endpoints before agents install or pay. Signed.

23 tools answering

HALLUX

by blvkware

Check that a package, module or DOI exists before an agent installs, imports or cites it.

4 tools answering

Presend dependency checks

by presendapp

Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

5 tools answering

Presend MCP Server

by presendapp

Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

40 tools answering

Vdb — questions

Answers built from our own checks of this server.

What can Vdb do?

It exposes 7 tools, read directly from the server on our last check. Among them: vdb_check_mcp_server, vdb_check_package, vdb_check_packages, vdb_list_slopsquatting, vdb_lookup, vdb_scan_lockfile and 1 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Vdb working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 1028 ms. The bar chart above shows every period we have measured.

How do I connect Vdb?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Vdb need an API key?

No. Vdb completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 7 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Vdb?

It answers our handshake in 1028 ms on average, which is faster than 4% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use Vdb?

The pypi package vdb-mcp was installed 215 times in the last week. Week over week that is -76%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Vdb open source?

We cannot say either way: written in Python, 0 stars on GitHub and 1 open issue, but we could not determine the licence, and without one the code is not open source by default.