mcpbeat Sign in

Valca MCP Server

local only

Valca runs on your own machine — the client starts it, so there is no endpoint to ping. 189 installs a week from pypi. Last commit 10 Oct 2026.

Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.

Installs per day peak 1 650 · avg 126 · -67% w/w
a month agotoday
189
Installs / week
pypi · valca
2
Stars
0 open issues
10 Oct 2026
Last commit
from GitHub
—
License
Python

What the code does

We read the source, 1 d ago · rules ccca72095570

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

            result = subprocess.run(
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

                        "  ~/.aws/scoped/<project>.credentials:/home/appuser/.aws/credentials:ro\n"

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Valca and you get told the day something new turns up.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add valca -- uvx valca
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "valca": {
      "args": [
        "valca"
      ],
      "command": "uvx"
    }
  }
}
~/.codex/config.toml
[mcp_servers.valca]
command = "uvx"
args = ["valca"]
.cursor/mcp.json
{
  "mcpServers": {
    "valca": {
      "args": [
        "valca"
      ],
      "command": "uvx"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "valca": {
      "args": [
        "valca"
      ],
      "command": "uvx"
    }
  }
}

Alternatives to Valca

same job, measured the same way
MCP Codeaudit
by infoinlet-marketplace

Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.

30 installs/wk local only
LeakRank Guard
by prototeemo

Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.

43 installs/wk local only
Codebase Doctor
by subhajitlucky

Read-only codebase audits for coding agents: secrets, RLS, deps, review verdicts. No writes.

2 652 installs/wk local only
AgentAegis
by astafford8488

Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

28 tools answering
E2b
by mcparmory

Create and manage secure sandboxes for running AI agent code

261 installs/wk local only
Python Code Validator
by jkanselaar

Validates AI-generated Python: syntax, lint, security scan and deterministic repair.

3 tools answering
Jikida
by jikida

Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.

44 installs/wk local only
Deep Noodle Security Review Guide
by myzie

Read-only guidance and report templates for reviewing application security with your own agent.

4 tools answering

Valca — questions

Answers built from our own checks of this server.

Why is there no uptime for Valca?
Valca runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the pypi package valca was installed 189 times last week.
How do I connect Valca?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls valca straight from pypi; nothing to host, nothing to sign up for.
How many people use Valca?
The pypi package valca was installed 189 times in the last week. Week over week that is -67%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Valca open source?
We cannot say either way: written in Python and 2 stars on GitHub, but we could not determine the licence, and without one the code is not open source by default.