mcpbeat Sign in

Husk MCP Server

by husk-security Your server? Claim it
local only

Husk runs on your own machine — the client starts it, so there is no endpoint to ping. 318 installs a week from npm. Last commit 28 Aug 2026.

Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs

Installs per day peak 165 · avg 8
a month agotoday
318
Installs / week
npm · husk-sec
5
Stars
0 open issues
28 Aug 2026
Last commit
0 releases in 90 days
MIT
License
Rust

What the code does

We read the source, 13 h ago · rules 3dff92dd89df

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Deletes files or strips permissions src/scan/checks/agent_config.rs:90
            || lower.contains("rm -rf")
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

File ships in the package but is absent from the source [пакет] bin/husk.cjs:1
этот файл ставится пользователю, но в репозитории его нет
Builds a database query by concatenation .github/workflows/release.yml:109
          sudo apt-get update
          sudo apt-get install -y ${{ matrix.apt }}
  const result = spawnSync(process.execPath, ["--check", shim], { stdio: "pipe" });
Builds a file path from a variable npm/build.mjs:68
  const source = path.join(binaries, target.rustTarget, binFile);
Touches key and credential files src/context.rs:145, src/guide/control/deps.rs:145, src/guide/control/machine.rs:113 и ещё 5
        ("npm config", home.join(".npmrc")),
Asks for container control access src/scan/checks/container.rs:26
            "A process with /var/run/docker.sock can ask the daemon for a privileged container, which is root on the host.",
Notebook runs shell commands tst/ecosystems/jupyter/analysis.ipynb:10
        "!pip install pandas==2.2.2 'scikit-learn'\n"

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Husk and you get told the day something new turns up.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add husk -- npx -y husk-sec
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "husk": {
      "args": [
        "-y",
        "husk-sec"
      ],
      "command": "npx"
    }
  }
}
~/.codex/config.toml
[mcp_servers.husk]
command = "npx"
args = ["-y", "husk-sec"]
.cursor/mcp.json
{
  "mcpServers": {
    "husk": {
      "args": [
        "-y",
        "husk-sec"
      ],
      "command": "npx"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "husk": {
      "args": [
        "-y",
        "husk-sec"
      ],
      "command": "npx"
    }
  }
}

Alternatives to Husk

same job, measured the same way
Skarn
by getskarn

Scans AI coding sessions and assistant configs for leaked secrets and risky hooks; local, redacted

620 installs/wk local only
AgentGuard — security checks for AI agents
by shuaicongxiaomai

Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev).

local only
I
LeakRank Guard
by prototeemo

Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.

96 installs/wk local only
Holster MCP
by nautaai

Local-first secret scanning, rotation, vault, and audit-log tools for AI agents.

90 installs/wk local only
I
Agent Security Scanner
by mikehzp

Scan AI agents for tool-calling vulnerabilities: prompt leaks, hijacking, injections, and more.

144 installs/wk local only
T
Secret Scanner
by knurl

Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.

1 tools answering
ContractOracle-Sentinel
by evozim

DeFi smart contract forensic auditor and vulnerability scanner.

answering
License
by thegridwork

Scan dependencies for license compliance — copyleft conflicts, unknown licenses, risk.

56 installs/wk local only

Husk — questions

Answers built from our own checks of this server.

Why is there no uptime for Husk?
Husk runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package husk-sec was installed 318 times last week.
How do I connect Husk?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls husk-sec straight from npm; nothing to host, nothing to sign up for.
How many people use Husk?
The npm package husk-sec was installed 318 times in the last week. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Husk open source?
Yes — it is published under the MIT licence, written in Rust and 5 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.