NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

GhostFree

io.github.shane-js/ghostfree ยท v0.2.0

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

Website Source code Set it up

Connect Runs on your machine

Terminal
claude mcp add ghostfree -e GHOSTFREE_DIR=<GHOSTFREE_DIR> -e GHOSTFREE_MIN_SEVERITY=<GHOSTFREE_MIN_SEVERITY> -e NVD_API_KEY=<NVD_API_KEY> -- npx -y [email protected]
claude_desktop_config.json
{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GHOSTFREE_DIR": "<GHOSTFREE_DIR>",
        "GHOSTFREE_MIN_SEVERITY": "<GHOSTFREE_MIN_SEVERITY>",
        "NVD_API_KEY": "<NVD_API_KEY>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GHOSTFREE_DIR": "<GHOSTFREE_DIR>",
        "GHOSTFREE_MIN_SEVERITY": "<GHOSTFREE_MIN_SEVERITY>",
        "NVD_API_KEY": "<NVD_API_KEY>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GHOSTFREE_DIR": "<GHOSTFREE_DIR>",
        "GHOSTFREE_MIN_SEVERITY": "<GHOSTFREE_MIN_SEVERITY>",
        "NVD_API_KEY": "<NVD_API_KEY>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
GHOSTFREE_DIR
Optional		Override the directory where GhostFree stores its data files (accepted-risks.yml, config.yml). Defaults to .ghostfree/ in the scanned repository root.
GHOSTFREE_MIN_SEVERITY
Optional		Minimum CVE severity level to surface. One of: CRITICAL, HIGH, MEDIUM (default), LOW.
NVD_API_KEY
Optional, secret		Optional NVD API key for higher rate limits when enriching CVE details. Free to request at https://nvd.nist.gov/developers/request-an-api-key.

Details

Package[email protected] (NPM, stdio)
First published7 Apr 2026
Last updated7 Apr 2026
Registry nameio.github.shane-js/ghostfree

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.