Project ยท AI tooling
Vulnerability Scanning
A staged pipeline for examining MCP server dependencies, source code and vulnerability findings.
- RepositoriesMCP server catalogue
- InspectMetadata, source and dependencies
- FindingsAdvisories and source matches
- ReviewEvidence and affected packages
- Status syncSeverity rules and audit events
Inspect the tools an agent can run
I built a research pipeline to examine MCP server repositories for dependency vulnerabilities and source-level risk signals. It starts with lightweight repository inspection, then performs deeper dependency and source analysis on cloned code.
The stages keep different kinds of evidence distinct. A dependency advisory, a secret-like string and a source-pattern match each need their own context before an operator decides how to act.
Three stages of evidence
The first stage fetches repository information through the GitHub API. The second clones source and runs dependency audits in Docker using pip-audit or npm audit, alongside checks for secrets and network calls. The third extracts source snippets for matching against vulnerability patterns.
A status synchronisation job reads scan results, applies severity rules and grace periods, and records state transitions. Its implementation includes idempotent updates that preserve an existing disabled state when the job runs again.
Connect findings to operations
The broader design connects dependency findings to sandbox quarantine and structured reasons an operator can inspect. The portfolio focus is the path from evidence collection to repeatable status decisions and an audit trail.