mcp: agent integration

vulkro-live mcp runs the Labs checks as an MCP server over stdio, so the agent checks a package or server before it installs or trusts it.

{
  "mcpServers": {
    "vulkro-live": { "command": "vulkro-live", "args": ["mcp"] }
  }
}

This works in Claude Code (.mcp.json), Claude Desktop, Cursor and any other MCP client. Or, in Claude Code: claude mcp add vulkro-live -- vulkro-live mcp. No key and no account.

Tools

Tool	What the agent gets
verify	A verdict for each package (npm, PyPI, crates)
verify_lockfile	verify over every package in a lockfile, plus lockfile integrity checks
provenance	Whether a package publishes build provenance (presence only)
warden	A scan of an MCP tool manifest
scan_content	A check of untrusted text (a web page, a tool result) for prompt injection and hidden characters. Offline
inspect	One GREEN / REVIEW / AVOID verdict for an MCP server
audit, foresee, skillscan, memcheck, cardcheck	The same checks as the CLI commands
lock, drift	Pin approved MCP tools and catch later changes
scan_repo	A security scan of your own code, see below

Results match the CLI commands of the same name.

scan_repo

scan_repo runs the vulkro scanner (vulkro scan --format sarif) when it is on your PATH and returns the SARIF. When it is not installed, the tool says how to get it. vulkro needs an active trial or Pro; see Your first scan.

vulkro-live mcp takes no flags. It serves until the client closes the connection.