Vdb

Working · 2.0 s

kr.ai.vdb/vdbv0.2.6 Domain verified

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://vdb.ai.kr/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

vdb_check_mcp_server

BEFORE recommending a community/unofficial MCP server, check it here. Scope risk is evaluated independently of advisory risk — an unvetted publisher asking for shell or filesystem access is refused even with a clean record. Follow the returned `agent_action`.

server_idstring, required

e.g. 'mcp:community/shell-runner'

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (7)

vdb_check_mcp_server

Argument	Type	Description
server_id*	string	e.g. 'mcp:community/shell-runner'

Input schema (JSON)

{
  "type": "object",
  "required": [
    "server_id"
  ],
  "properties": {
    "server_id": {
      "type": "string",
      "description": "e.g. 'mcp:community/shell-runner'"
    }
  }
}

vdb_check_package

BEFORE recommending or installing any package, check it here. The response carries `agent_action`: REFUSE (do not add it — relay the `because` text to the user), CONFIRM (ask the user first), or PROCEED. A failed or rate-limited call also answers REFUSE; never proceed unchecked. Also returns the underlying advisories, slop risk, and KEV status as supporting data.

Argument	Type	Description
purl*	string	Package URL, e.g. 'pkg:npm/lodash' or 'pkg:pypi/requests'
version	string	Optional version. If supplied, range matching is applied.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "purl"
  ],
  "properties": {
    "purl": {
      "type": "string",
      "description": "Package URL, e.g. 'pkg:npm/lodash' or 'pkg:pypi/requests'"
    },
    "version": {
      "type": "string",
      "description": "Optional version. If supplied, range matching is applied."
    }
  }
}

vdb_check_packages

Bulk-check several packages in one call — always prefer this over repeated vdb_check_package. Each result carries its own `agent_action` (REFUSE / CONFIRM / PROCEED) plus a top-level `agent_action` for the batch. Follow them; relay `because` when refusing. Send names EXACTLY as written — do not correct a typo first, the call is the typo test.

Argument	Type	Description
packages*	array	List of PURLs or 'ecosystem/name' shorthand.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "packages"
  ],
  "properties": {
    "packages": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of PURLs or 'ecosystem/name' shorthand."
    }
  }
}

vdb_list_slopsquatting

List packages currently flagged as slopsquatting candidates in a given ecosystem.

Argument	Type	Description
limit	integer
ecosystem	string	npm \| PyPI \| crates.io \| Go \| Maven

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 50
    },
    "ecosystem": {
      "type": "string",
      "description": "npm | PyPI | crates.io | Go | Maven"
    }
  }
}

vdb_lookup

Fetch a single vulnerability by ID or alias (e.g. CVE-2024-1234, GHSA-xxxx-yyyy-zzzz, VDB-SLOP-…).

Argument	Type	Description
id*	string

Input schema (JSON)

{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string"
    }
  }
}

vdb_scan_lockfile

BEFORE merging, scan the resolved lockfile. Checking the packages someone chose misses the transitive ones nobody did — which is usually where the risk is. Pass the file contents (package-lock.json, requirements.txt, uv.lock, go.sum, Cargo.lock, a CycloneDX SBOM, …). Returns `agent_action`: REFUSE means do not merge.

Argument	Type	Description
path	string	Local runs only (uvx vdb-mcp): read the file here instead of passing content.
content	string	The file's text.
filename*	string	e.g. 'package-lock.json' — the format is detected from it

Input schema (JSON)

{
  "type": "object",
  "required": [
    "filename"
  ],
  "properties": {
    "path": {
      "type": "string",
      "description": "Local runs only (uvx vdb-mcp): read the file here instead of passing content."
    },
    "content": {
      "type": "string",
      "description": "The file's text."
    },
    "filename": {
      "type": "string",
      "description": "e.g. 'package-lock.json' — the format is detected from it"
    }
  }
}

vdb_search

Free-text search over the VDB vulnerability corpus.

Argument	Type	Description
limit	integer
query*	string

Input schema (JSON)

{
  "type": "object",
  "required": [
    "query"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 20
    },
    "query": {
      "type": "string"
    }
  }
}