# Security Vulnerability Scanner MCP for AI Agents MCP

> Security Vulnerability Scanner MCP provides deep, AST-based security analysis for code generated by your AI agents. It moves beyond simple pattern matching to identify structural risks like SQL injection, command injection, and path traversal, ensuring that agent-written code doesn't introduce critical supply-chain vulnerabilities into your production environment.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_VzqULA3f5yxIBgbrQrruv8bMna461DtX1kzt5Mei/mcp
- **Tags:** security, ast, vulnerability, code-audit, devops

## Description

When you let an AI agent write code, you're essentially inviting a high-speed developer into your codebase who might not always follow your security protocols. This MCP changes that by acting as a structural inspector. Instead of just looking for obvious text patterns, it analyzes the actual logic and structure of the code to find deep-seated flaws that simple scanners miss. It catches things like command injection or path traversal by understanding how the code is built, not just what it says. This means you can stop worrying about every line of code your agent spits out. You can integrate this into your workflow through the Vinkius catalog, giving your agent a built-in safety net. It turns a potentially risky process into a controlled, verifiable one where security is baked into the generation loop rather than being an afterthought you have to fix later.

## Tools

### check_pattern_definition
g., SQL_INJECTION) is supported.

Validates if a specific vulnerability pattern is currently supported by the engine's logic

### get_vulnerability_summary
Provides a high-level overview of the security posture of a specific codebase. It helps you understand the overall risk level at a glance.

### scan_source_code
Performs a deep AST-based security scan on a specific file or directory. It looks at the code structure to find deep logic flaws.

## Prompt Examples

**Prompt:** 
```
Is the code in the current directory safe from SQL injection?
```

**Response:** 
```
I've analyzed the source code in the current directory. 

**Security Report:**
- **Status:** ⚠️ Vulnerabilities Detected
- **Type:** SQL Injection
- **Location:** `db_manager.py` (Line 42)
- **Details:** The query uses string formatting instead of parameterized queries, which allows for potential injection.

I recommend refactoring the query to use prepared statements.
```

**Prompt:** 
```
Give me a summary of the security posture of this project.
```

**Response:** 
```
Here is the current security overview for the project:

| Metric | Value |
| :--- | :--- |
| **Total Vulnerabilities** | 3 |
| **Critical** | 1 (Command Injection) |
| **High** | 2 (Path Traversal) |
| **Medium/Low** | 0 |

**Overall Risk Level: High.** The command injection in `utils/shell.py` is a priority fix.
```

**Prompt:** 
```
Check if this code meets our security policy of zero critical vulnerabilities.
```

**Response:** 
```
I have checked the scan results against your policy.

**Result: ❌ Policy Violation**

**Reason:** The scan detected **1 Critical vulnerability** (Command Injection in `api/routes.py`). Your policy requires a maximum of 0 critical vulnerabilities. You must resolve this issue before the code can be considered compliant.
```

## Capabilities

### Inspect file structures
Analyze specific files or entire directories to find hidden security flaws.

### Audit project health
Get a high-level view of the security posture across your entire codebase.

### Enforce security rules
Check if new code meets your specific, predefined security requirements.

### Detect injection risks
Identify SQL and command injection vulnerabilities through structural analysis.

### Prevent path traversal
Stop unauthorized file access by spotting dangerous path manipulation patterns.

## Use Cases

### Validating AI-generated PRs
A developer uses an agent to write a new API endpoint and immediately runs a scan to ensure no injection flaws were introduced.

### Automated Security Gatekeeping
A DevOps engineer sets a policy that prevents any code from being merged if the scan detects a critical vulnerability.

### Legacy Code Auditing
A security researcher uses the scanner to quickly map out the risk profile of an existing repository.

### Supply Chain Protection
An engineer checks newly added dependencies and their implementation code for structural security risks.

## Benefits

- Catch structural flaws that regex-based scanners miss by using AST analysis.
- Stop SQL and command injection before they ever reach your production environment.
- Automate security compliance by checking code against custom policy thresholds.
- Reduce the manual review time required for agent-generated pull requests.
- Identify path traversal risks by analyzing how your code handles file systems.
- Get a clear, high-level view of your project's security health instantly.

## How It Works

The bottom line is you get a structural security audit that catches the dangerous logic errors AI agents often introduce.

1. Connect the MCP to your AI client through the Vinkius platform.
2. Point your agent toward the files or directories you want to check.
3. Receive a detailed report of vulnerabilities or a pass/fail confirmation against your policy.

## Frequently Asked Questions

**How does the Security Vulnerability Scanner MCP find bugs in AI code?**
It uses AST-based analysis, which means it looks at the actual structure and logic of the code rather than just searching for specific words. This allows it to find complex injection flaws that simple scanners miss.

**Can I use the Security Vulnerability Scanner MCP to enforce my own coding standards?**
Yes. You can use it to check if the code generated by your agent meets specific security thresholds you've defined, ensuring every piece of code stays within your safety limits.

**Will this MCP work with my existing AI coding tools?**
Yes, as long as you are using an MCP-compatible client like Claude, Cursor, or Windsurf, you can connect this tool and start scanning immediately.

**What kind of vulnerabilities does the Security Vulnerability Scanner MCP detect?**
It is specifically designed to catch structural risks like SQL injection, command injection, and path traversal that are common in improperly handled code logic.

**Is this MCP better than a standard linter?**
Yes, for security. While a linter checks for style and basic errors, this MCP performs deep structural analysis to find actual security vulnerabilities that could be exploited by attackers.

**How does the scanner detect vulnerabilities?**
The scanner uses Abstract Syntax Tree (AST) pattern matching to analyze the actual structure of the code, ensuring it identifies real execution paths while ignoring comments and strings.

**What kind of vulnerabilities can it find?**
It detects SQL injection, command injection, path traversal, insecure deserialization, and hardcoded credentials.

**Can I enforce security rules?**
Yes, you can use `validate_security_policy` to check if the scan results meet your specific maximum allowed thresholds for critical or high-severity issues.

**Can I scan an entire project?**
Yes, by using the `scan_source_code` tool and providing the root directory path as the target path.

**What kind of vulnerabilities are covered?**
It covers SQL injection, command injection, path traversal, insecure deserialization, and hardcoded credentials.