Loading...
Skip to main content
GeekWala

GeekWala MCP Server for Dependency Vulnerability Scanning

Let your AI coding assistant check a package version, scan a manifest or look up a CVE, with EPSS and CISA KEV context. Read-only, free API token.

GeekWala runs a hosted Model Context Protocol (opens in a new tab) (MCP) server at https://www.geekwala.com/mcp. Connect it to Claude Code, Cursor or VS Code and your assistant can ask GeekWala whether a dependency has known vulnerabilities while it is choosing, adding or upgrading it, instead of guessing from training data that may be months old.

Results come from the same data as the GeekWala scanner: OSV advisories across npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems and NuGet, enriched with EPSS exploit-probability scores and the CISA KEV catalog of vulnerabilities known to be exploited. The server is read-only: it never changes your code, your projects or your account.

Get a free API token (opens in a new tab)See the setup steps

Three read-only tools

Your assistant picks the right tool from its description. Every tool only reads from GeekWala's vulnerability data.

check_package

Check one package version

Known vulnerabilities for one exact package version, most urgent first: CISA KEV, then EPSS exploit probability, then CVSS and severity. Each finding lists the versions that fix it and links to its GeekWala CVE page. Use it before adding or upgrading a dependency. It needs the exact installed version, not a range.

  • ecosystem (required) npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems or NuGet.
  • name (required) Package name as the registry spells it.
  • version (required) The exact version, such as 4.17.21.

scan_dependencies

Scan a manifest or lockfile

Scans the text of a dependency file (package-lock.json, composer.lock, requirements.txt, go.mod, pom.xml and other supported manifests and lockfiles). It returns a summary for the whole file, then the most urgent vulnerable packages first, with fixed versions. Long results are capped and say so. Read-only: no project, scan or file is created or stored on your account.

  • content (required) The complete text of the file.
  • filename (optional) The file name, such as package-lock.json. Inferred from the content when omitted.

get_vulnerability

Look up a CVE or advisory

Details for one advisory from the GeekWala database: severity, CVSS, EPSS, CISA KEV status, affected packages and fixed versions, and references. This is a database lookup only, so an advisory GeekWala has not ingested returns "not found".

  • id (required) A CVE id, a GitHub advisory id (GHSA-...) or another OSV id such as PYSEC-... or GO-....

Things to ask your assistant

  • “Is lodash 4.17.20 safe to use? Check it for known vulnerabilities.”
  • “Scan this package-lock.json and tell me which findings are actively exploited.”
  • “What does CVE-2021-44228 affect, and which version fixes it?”

Step 1: get a free API token

  1. Create a free GeekWala account (opens in a new tab) and verify your email address.
  2. Open the API tokens page (opens in a new tab) and create a token with the scan:read ability. That is the only ability the MCP server needs, and it is available on every plan.
  3. Copy the token when it is shown. GeekWala shows it once, so store it in a password manager or an environment variable, never in a file you commit.

A Free account can hold 1 API token.

Step 2: connect your client

The server uses the Streamable HTTP transport and expects your token in an Authorization: Bearer <token> header. The snippets below follow each vendor's current documentation; they have not yet been tested end to end with a live token. Replace the placeholder, or set the environment variable the snippet names, and never paste a real token into a shared file.

Claude Code

Add the server from your terminal. It is stored in local scope by default (private to you, only this project, in your Claude Code configuration file); add --scope user to make it available in every project.

Terminal
claude mcp add --transport http geekwala https://www.geekwala.com/mcp \
  --header "Authorization: Bearer YOUR_GEEKWALA_TOKEN"

Run claude mcp list, or /mcp inside Claude Code, to confirm the server connected.

Alternative: a shared .mcp.json

To share the setup with a team, put it in .mcp.json and keep the token out of the file with environment variable expansion; each teammate sets GEEKWALA_API_TOKEN in their own environment. If you get an invalid-token error, check the variable is non-empty in the shell that launches Claude Code.

.mcp.json
{
  "mcpServers": {
    "geekwala": {
      "type": "http",
      "url": "https://www.geekwala.com/mcp",
      "headers": {
        "Authorization": "Bearer ${GEEKWALA_API_TOKEN}"
      }
    }
  }
}

Cursor

Add the server to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project). Cursor expands ${env:NAME} in url and headers, so export GEEKWALA_API_TOKEN in the environment Cursor starts from.

mcp.json
{
  "mcpServers": {
    "geekwala": {
      "url": "https://www.geekwala.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GEEKWALA_API_TOKEN}"
      }
    }
  }
}

VS Code (GitHub Copilot)

Add the server to .vscode/mcp.json in your workspace, or run MCP: Open User Configuration from the Command Palette to add it to your profile. The inputs entry makes VS Code prompt you for the token the first time the server starts and store it securely, so nothing secret lands in the file. Input prompts work in this VS Code format only, not in the portable .mcp.json format.

.vscode/mcp.json
{
  "inputs": [
    {
      "type": "promptString",
      "id": "geekwala-token",
      "description": "GeekWala API token (scan:read)",
      "password": true
    }
  ],
  "servers": {
    "geekwala": {
      "type": "http",
      "url": "https://www.geekwala.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:geekwala-token}"
      }
    }
  }
}

Using another MCP client? Any client that supports the Streamable HTTP transport and custom request headers can connect with the endpoint and the Authorization header above. The setup syntax was checked against the vendors' documentation for the three clients on this page only.

Security and privacy

  • Read-only. The server needs only the scan:read token ability and exposes no tool that changes your projects, settings or repository.
  • Manifests are analysed, not stored. scan_dependencies parses the file text you send and returns findings. No project, scan or file is created or stored on your account, and the contents of the file are never logged or stored. The package names and versions in it are looked up in GeekWala's shared vulnerability cache, which is not tied to your account.
  • Usage metrics we keep. To enforce limits and spot abuse we store counts by tool, hour and outcome (including the kind of error), per account ID, and per anonymised IP address: a keyed hash plus the network prefix (a /24 for IPv4), never the raw address. Hourly rows are kept for 30 days and daily totals for 365 days. We also keep a permanent record of when each token was first used; it is unlinked from your account if the account is deleted.
  • Application logs. Our operational logs can include, for each tool call, your account ID, the tool, its outcome and duration, the size in bytes of what you sent, and the IP address of the connection. For scan_dependencies the file name is logged too. Warnings written when a limit is hit also carry the IP address. We never log your token or the contents of the files you send. Log retention is separate from the metrics periods above.
  • Rate-limit state. Connection-level rate limits and the failed-authentication lockout key on the connecting IP address, and that state expires on its own within minutes.
  • You stay in control of the token. Revoke it any time from the API tokens page (opens in a new tab); the assistant loses access immediately. Use one token per machine so a single revocation is easy.
  • Your assistant sees the results. Whatever a tool returns is passed to your AI model provider as part of the conversation. Do not send manifests you are not allowed to share with that provider. Advisory text in the results (summaries, details, references) comes from third-party sources and is labelled as untrusted data for your assistant, which is told never to follow instructions or open links found in it. Treat it with the same caution as any web content.

More on how GeekWala handles scanned data: Platform security.

Limits

Limits follow the plan of the account that owns the token, the same as the REST API. Each plan has a per-minute request limit and a daily cap on tool calls.

Scroll the table sideways to see every column.

PlanRequests per minutescan_dependencies per minuteTool calls per dayscan_dependencies per day
Free1201520050
Pro240302000500
  • The daily caps are counted per account over the UTC day and reset at 00:00 UTC. Every tool call counts toward the daily total, and each scan_dependencies call also counts toward its own daily cap. An account on a Pro trial uses the Pro limits.
  • scan_dependencies accepts files up to 512 KB and up to 500 packages per scan, the same limits as the REST API scan endpoint.
  • A request over a limit is declined with HTTP 429. Per-minute limits clear within a minute; daily caps clear at the next 00:00 UTC.

Need higher limits? See pricing for what each plan includes and to upgrade.

How it fits with npm audit, pip-audit, Snyk, Dependabot, Trivy and Grype

The MCP server does not replace the scanners you run in CI. Those tools check a project, image or repository you point them at. This server answers a different question at a different moment: “is this package version safe?” while your assistant is choosing or upgrading a dependency, with EPSS and CISA KEV signals so you can tell the findings that matter from the ones that do not. Use it alongside whatever you already run.

ToolTypically used forCompared
npm auditAuditing the installed dependency tree of an npm projectGeekWala vs npm audit
pip-auditAuditing Python environments and requirements filesAlternatives to pip-audit
SnykA commercial developer-security platformGeekWala vs Snyk
DependabotDependency alerts and update pull requests on GitHubGeekWala vs Dependabot
TrivyScanning container images, file systems and repositoriesGeekWala vs Trivy
GrypeScanning container images and file systems for known vulnerabilitiesGeekWala vs Grype

See all of the side-by-side pages on Compare tools. To gate pull requests in CI, use the GitHub Actions integration.

Frequently asked questions

Is the MCP server free?

Yes. You need a GeekWala account and an API token, and a free account can create one. Free accounts run at the Free limits shown above; paid plans raise them. See pricing.

What happens when I hit a limit?

The tool call is declined with HTTP 429 and a JSON-RPC error that says which limit you reached. For the daily cap the error names the cap and when it resets; the counter resets at 00:00 UTC. A Free account can make 200 tool calls a day. Per-minute limits clear within a minute, so a short wait and a retry is enough. To raise the ceiling, see pricing.

Can it change my code or my GeekWala projects?

No. All three tools are read-only and the token only needs the scan:read ability. The server does not edit files, open pull requests or modify your projects.

Which ecosystems does it cover?

npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems and NuGet, the same ecosystems as the GeekWala scanner.

What do EPSS and CISA KEV add?

CVSS rates how severe a flaw could be. EPSS estimates how likely it is to be exploited, and the CISA KEV catalog lists flaws already exploited in the wild. Returning all three lets your assistant tell you what to fix first instead of listing everything at the same weight. Read more in Understanding vulnerabilities.

Can I use it from a different MCP client?

Probably, if the client supports the Streamable HTTP transport and custom request headers: use the endpoint above and an Authorization: Bearer header. Setup for Claude Code, Cursor and VS Code is documented on this page; other clients are not verified.

The assistant says it is unauthorised. What now?

Check that the token is current and has the scan:read ability, and that the header reads Authorization: Bearer followed by the token. If you set the token through an environment variable, restart the client so it picks the variable up. You can create a new token on the API tokens page (opens in a new tab).

Learn more

Get a free GeekWala API token

Create an account, generate a scan:read token, and give your AI coding assistant a vulnerability database to check against.

Create a free account (opens in a new tab)View Pricing