GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.
接入配置
选择客户端，复制配置，再按项目文档补齐环境变量。
claude mcp add ghostfree --env NVD_API_KEY='<NVD_API_KEY>' -- npx -y ghostfree --repo-path '<REPO_PATH>'~/.codex/config.toml
[mcp_servers.ghostfree]
command = "npx"
args = ["-y", "ghostfree", "--repo-path", "<REPO_PATH>"]
env = { NVD_API_KEY = "<NVD_API_KEY>" }
# codex mcp add ghostfree --env NVD_API_KEY='<NVD_API_KEY>' -- npx -y ghostfree --repo-path '<REPO_PATH>'~/.cursor/mcp.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"ghostfree": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"ghostfree": {
"command": "npx",
"args": [
"-y",
"ghostfree",
"--repo-path",
"<REPO_PATH>"
],
"env": {
"NVD_API_KEY": "<NVD_API_KEY>"
}
}
}
}需要的环境变量
NVD_API_KEY
把占位值换成你自己的密钥；不要把密钥提交到代码仓库。