mcpbeat Sign in

Vulnify MCP Server

answering

Vulnify is answering right now. Last checked 12 min ago. 981 installs a week from npm. Last commit 15 Oct 2026.

Ask Vulnify before an AI agent acts. Check, record, and read policy decisions.

Installs per day peak 832 · avg 32
a month agotoday
Uptime history 7 days of history
7 days agonow
100.0%
Uptime 24h
92 of 92 checks
—
Tools
hidden behind auth
406 ms
Response time
average over 24h
981
Installs / week
npm and PyPI

Nothing serious here today

Today is the operative word: we check Vulnify every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 12 min ago.

run in your terminal
claude mcp add mcp --transport http https://mcp.vulnify.io/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "mcp": {
      "url": "https://mcp.vulnify.io/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.mcp]
url = "https://mcp.vulnify.io/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "mcp": {
      "url": "https://mcp.vulnify.io/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "mcp": {
      "url": "https://mcp.vulnify.io/mcp"
    }
  }
}

This one needs environment variables set before it will start: VULNIFY_API_KEY (Vulnify API key (vln_live_... or vln_test_...) for the local stdio process. The hosted server signs in with Vulnify and does not need this variable.), VULNIFY_BASE_URL (API base URL. Defaults to https://api.vulnify.io.). The author declared them in the registry entry; get the values from the project itself.

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URLTransportStateLatencyChecked
https://mcp.vulnify.io/mcp streamable-http sign-in 373 ms 12 min ago

Alternatives to Vulnify

same job, measured the same way
Tanilo
by tkcollective

Tanilo checks the premise before an AI agent acts.

363 installs/wk local only
Tently
by tently-team

Tently, the AI PR reviewer for GitHub: agents check team decisions before they write code.

356 installs/wk local only
Qorami
by loicfontaine-max

Check an email before an AI agent sends it: send / ask a human / block. Detects prompt injection.

21 installs/wk local only
Phronesis Hermes
by phronesisintel

Decision-assurance for AI agents: an auditable action boundary + receipt before it acts.

answering
probe402-check
by probe402

Ask probe402's public record about an x402 or MPP endpoint before an agent pays it.

30 installs/wk local only
VERAX
by verax-ai

The body an agent asks before it acts: decide, approve, and keep a signed record on your machine.

1 105 installs/wk local only
commit-check MCP
by commit-check

Commit policy as code for AI agents: check commit messages, branch names and authors before a push

419 installs/wk local only
ActionBox Human Input
by actionbox

Human review for AI agents: ask through ActionBox and retrieve a typed decision before proceeding.

answering

Vulnify — questions

Answers built from our own checks of this server.

Why is there no tool list for Vulnify?
The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.
Is Vulnify working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 406 ms. The bar chart above shows every period we have measured.
How do I connect Vulnify?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.
How do you sign in to Vulnify?
No API key is involved. Vulnify answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.
How fast is Vulnify?
It answers our handshake in 406 ms on average, which is faster than 30% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use Vulnify?
The npm package @vulnify/mcp was installed 981 times in the last week. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Vulnify open source?
Yes — it is published under the MIT licence, written in TypeScript and 2 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.