mcpbeat Sign in

Feldspar free repository security scan MCP Server

by project-feldspar Your server? Claim it
answering

Feldspar free repository security scan is answering right now. Last checked 2 min ago. It exposes 2 tools. Last commit 24 Oct 2026.

Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.

Uptime history 59 days of history · worst day 95%
59 days agonow
95.7%
Uptime 24h
88 of 92 checks
2
Tools
read from the server
58 ms
Response time
average over 24h
0
Stars
last commit 24 Oct 2026

What changed 36

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 5 October 2026. No other catalogue keeps this.

24 Oct 2 tool descriptions were rewritten audit_pricing, scan_repository
24 Oct a tool changed the parameters it asks for2 times that day scan_repository
21 Oct a tool description was rewritten scan_repository
20 Oct a tool changed version
19 Oct a tool changed version4 times that day
17 Oct a tool changed version3 times that day
16 Oct a tool changed version11 times that day
15 Oct a tool changed version5 times that day
13 Oct a tool description was rewritten2 times that day audit_pricing
11 Oct a tool changed version
and 25 more, back to 5 October 2026

What the code does

We read the source, 22 h ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command action_run.py:89, web/server.py:553 
    r = subprocess.run(argv)
Dumps the whole environment web/server.py:545 
        env = dict(os.environ)

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 2 min ago.

run in your terminal
claude mcp add scan --transport http https://project-feldspar.com/mcp
Settings → Connectors → Add custom connector, then paste this address
https://project-feldspar.com/mcp
~/.codex/config.toml
[mcp_servers.scan]
url = "https://project-feldspar.com/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "scan": {
      "url": "https://project-feldspar.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "scan": {
      "type": "http",
      "url": "https://project-feldspar.com/mcp"
    }
  }
}

Available tools 2

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

audit
audit_pricing
Returns the scope, prices, delivery times, terms and order links of Project Feldspar's paid code audits, which an AI agent performs. Use it when the user asks about a paid code audit. No arguments.
scan
scan_repository
Clone a public git repository and run feldspar-scan: OSV.dev advisories for pinned dependencies in lockfiles (npm, pnpm, yarn, pip/uv/poetry, Cargo, Go, Gemfile.lock), secret patterns with redacted evidence, and configuration lint. Returns a JSON report with summary counts and per-finding severity, file, line, advisory id and fixed versions. Deterministic, no LLM involved. Takes 2-90 s depending on repository size. Returns the most severe findings first, 25 unless max_findings asks for more (up to 200); the summary counts cover every finding, and large per-file breakdowns are left out and named under omitted.

Endpoints

URLTransportStateLatencyChecked
https://project-feldspar.com/mcp streamable-http answering 35 ms 2 min ago

Alternatives to Feldspar free repository security scan

same job, measured the same way
Python Code Validator
by jkanselaar

Validates AI-generated Python: syntax, lint, security scan and deterministic repair.

3 tools answering
FinishKit
by finishkit

FinishKit MCP: scan GitHub repos for security vulnerabilities, deployment blockers, and quality

43 installs/wk local only
MCP Codeaudit
by infoinlet-marketplace

Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.

51 installs/wk local only
NPMScan
by salemalem

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

23 tools answering
GhostFree
by shane-js

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

30 installs/wk local only
QuantumScan PQC Scanner
by gaiabio12-design

PQC scanner for GitHub repos and smart contracts. Detects quantum-vulnerable ECDSA/RSA.

4 tools answering
ScanPay — Code Security Oracle
by misterio070

Deterministic code security scan + tx preflight, paid in USDC via x402.

7 tools answering
CI Guard MCP
by carelessdept

Local-first static repository security and configuration drift auditor (CLI, GitHub Action & MCP).

63 installs/wk local only

Feldspar free repository security scan — questions

Answers built from our own checks of this server.

What can Feldspar free repository security scan do?
It exposes 2 tools, read directly from the server on our last check. Among them: audit_pricing, scan_repository. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Feldspar free repository security scan working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 88 of 92 checks got a reply (95.7%), average response time 58 ms. The bar chart above shows every period we have measured.
How do I connect Feldspar free repository security scan?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Feldspar free repository security scan need an API key?
No. Feldspar free repository security scan completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 2 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Feldspar free repository security scan?
It answers our handshake in 58 ms on average, which is faster than 99% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is Feldspar free repository security scan open source?
The code is open source: it is published under the MIT licence, written in Python and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at project-feldspar.com, which runs on its operator's own terms.