GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add ghostfree --env NVD_API_KEY='<NVD_API_KEY>' -- npx -y ghostfree --repo-path '<REPO_PATH>'~/.codex/config.toml
[mcp_servers.ghostfree]
command = "npx"
args = ["-y", "ghostfree", "--repo-path", "<REPO_PATH>"]
env = { NVD_API_KEY = "<NVD_API_KEY>" }
# codex mcp add ghostfree --env NVD_API_KEY='<NVD_API_KEY>' -- npx -y ghostfree --repo-path '<REPO_PATH>'~/.cursor/mcp.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"ghostfree": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}Environment variables
NVD_API_KEY
Replace the placeholders with your own credentials and keep them out of version control.