{
  "markdown": "# vdb-mcp\n\nmcp-name: kr.ai.vdb/vdb\n\nMCP (Model Context Protocol) server for **[VDB](https://vdb.ai.kr)** — the\nAI-aware vulnerability database. Lets Claude Desktop, Claude Code, Cursor,\nCline, Continue, and any MCP client check packages **while generating code**:\nknown CVEs, slopsquatting (LLM-hallucinated package names an attacker may have\nregistered), CISA KEV status, MCP-server trust profiles, and more.\n\n## Quick start\n\n```bash\nuvx vdb-mcp          # or: pipx run vdb-mcp\n```\n\nClaude Desktop (`claude_desktop_config.json`) / Cursor (`.cursor/mcp.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"vdb\": { \"command\": \"uvx\", \"args\": [\"vdb-mcp\"] }\n  }\n}\n```\n\n**No install at all** — point any streamable-HTTP MCP client at the hosted\nendpoint:\n\n```json\n{\n  \"mcpServers\": {\n    \"vdb\": { \"url\": \"https://vdb.ai.kr/mcp\" }\n  }\n}\n```\n\nThat's it — the server talks to the hosted instance at `https://vdb.ai.kr`\nby default. Anonymous use gets a free per-IP trial; add an API key for\nunmetered access (free at <https://vdb.ai.kr/signup>):\n\n```json\n{\n  \"mcpServers\": {\n    \"vdb\": {\n      \"command\": \"uvx\",\n      \"args\": [\"vdb-mcp\"],\n      \"env\": { \"VDB_API_TOKEN\": \"vdb_...\" }\n    }\n  }\n}\n```\n\n## Tools\n\n| Tool | What it does |\n|---|---|\n| `vdb_check_package` | Check one package (purl + optional version) for vulnerabilities, slop risk, KEV |\n| `vdb_check_packages` | Bulk slopsquatting / risk check for a list of packages |\n| `vdb_lookup` | Fetch one advisory by ID (CVE-…, GHSA-…, VDB-SLOP-…) |\n| `vdb_search` | Free-text search over the vulnerability corpus |\n| `vdb_check_mcp_server` | Trust tier + permission scopes of a community MCP server |\n| `vdb_list_slopsquatting` | Current slopsquatting candidates per ecosystem |\n\n## Environment\n\n| Variable | Default | Meaning |\n|---|---|---|\n| `VDB_API_URL` | `https://vdb.ai.kr` | VDB instance to query (set for self-hosted) |\n| `VDB_API_TOKEN` | *(empty)* | `vdb_…` API key — unmetered, per-account quota |\n| `MCP_MODE` | `stdio` | `stdio` or `sse` (long-running HTTP server) |\n| `MCP_PORT` | `7700` | SSE port |\n\n## Why\n\nLLMs hallucinate package names; attackers register them (slopsquatting).\nLLMs also happily recommend packages with known RCEs. VDB gives your agent a\nguardrail: one tool call before `npm install` / `pip install`. See\n<https://vdb.ai.kr/connect> for the one-line prompt variant that needs no MCP\nat all.\n\n## License\n\n[Elastic License 2.0](https://www.elastic.co/licensing/elastic-license) —\nfree to use, including inside commercial organizations and CI. The only\nrestrictions: you may not offer this software to third parties as a hosted\nor managed service, or resell it as a product. Commercial licensing beyond\nthat: <dev@egdee.com>. API usage is governed by the VDB service terms\nregardless of how you call it.\n",
  "bytes": 2773,
  "sha": "20122eb609828f3260977ebe0be6b143117b01972518c9652b71ba3f0f1503e6",
  "repo_slug": "0pstech/vdb-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_kr_ai_vdb_vdb_9bf2f32f/readme"
}