Scan MCP server
{
"mcpServers": {
"project-feldspar-scan": {
"type": "http",
"url": "https://project-feldspar.com/mcp"
}
}
}{
"mcpServers": {
"project-feldspar-scan": {
"type": "http",
"url": "https://project-feldspar.com/mcp"
}
}
}{
"mcpServers": {
"project-feldspar-scan": {
"type": "http",
"url": "https://project-feldspar.com/mcp"
}
}
}{
"servers": {
"project-feldspar-scan": {
"type": "http",
"url": "https://project-feldspar.com/mcp"
}
}
}{
"mcpServers": {
"project-feldspar-scan": {
"type": "http",
"url": "https://project-feldspar.com/mcp"
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsonversion 0.2.0
What it does
A deterministic scanner for public git repositories that checks for vulnerable dependencies via OSV.dev, leaked secrets, and configuration issues. It runs as a CLI tool, GitHub Action, hosted web endpoint, or MCP server with no authentication or telemetry required.
- Run security scans on repositories as a pre-merge gate in CI/CD pipelines to catch vulnerable dependencies and secrets before code is committed.
- Scan public repositories on GitHub, GitLab, Codeberg, or Bitbucket through the hosted web endpoint without installing software locally.
- Integrate repository scanning into AI agents and code editors via the MCP server interface to provide real-time security feedback.
Tools this server exposes
| Tool | Does |
|---|---|
| scan_repository | Scans a public repository for vulnerable dependencies (from OSV.dev), leaked secrets, and configuration issues; returns results as JSON. |
| audit_pricing | Describes pricing and features of the paid audit tier from Project Feldspar. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.