Reachvuln runs on your own machine — the client starts it, so there is no endpoint to ping. 267 installs a week from npm. Last commit 3 Nov 2026.
Rank vulnerabilities by whether the vulnerable code path is reachable in your code.
Nothing serious here today
Today is the operative word: we check Reachvuln every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add reachvuln -- npx -y @reneturcios/reachvuln{
"mcpServers": {
"reachvuln": {
"command": "npx",
"args": [
"-y",
"@reneturcios/reachvuln"
]
}
}
}[mcp_servers.reachvuln]
command = "npx"
args = ["-y", "@reneturcios/reachvuln"]{
"mcpServers": {
"reachvuln": {
"command": "npx",
"args": [
"-y",
"@reneturcios/reachvuln"
]
}
}
}{
"servers": {
"reachvuln": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@reneturcios/reachvuln"
]
}
}
}Alternatives to Reachvuln
same job, measured the same way13 rules that decide whether a vulnerability report ever reaches you
Strict AI code reviewer powered by Groq. Finds bugs and vulnerabilities.
Linters check your code. Invigil checks whether your repo is legible — to newcomers and AI agents.
Scan a GitHub repository for vulnerabilities, with proof for every finding, from your coding agent.
Dates every quantum-vulnerable algorithm in your code against the NIST IR 8547 clock: deprecated aft
Zenable cleans up sloppy AI code and prevents vulnerabilities with deterministic guardrails
MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.
Analyzes code for bugs, security vulnerabilities, and code smells
Reachvuln — questions
Answers built from our own checks of this server.