Skip to main content

vulkro mcp

The Model Context Protocol surface: run Vulkro as an MCP server that Claude Desktop, Cursor, Windsurf, Continue, and VS Code MCP clients can call.

Today the only action is serve. The command group leaves room for future sub-actions without breaking the CLI surface.

vulkro mcp <COMMAND>
CommandDescription
serveRun Vulkro as an MCP server over stdio (default) or SSE.

The sibling subcommand vulkro mcp-audit audits MCP host configs. It is not part of this group: it is kept at its original top-level path for backwards compatibility.

Tools exposed by vulkro mcp serve​

Any JSON-RPC 2.0 MCP client can call these sixteen tools. Every one is deterministic and calls no model. Every tool and every language is included in the trial and in Pro. Full input shapes are on the vulkro mcp serve page.

ToolDescription
scan_project({path, format?})Full project scan, plus a scan_id for re-filtering without re-scanning. Agents should pass format: "compact": one compact table of findings, most severe first, each with its flagged line, sized to fit a tool result. json (default) is the full vulkro scan -f json shape; summary is counts only.
scan_file({path})Scan and return only the findings whose source file matches the given path. Detects the containing project automatically.
get_findings({scan_id, severity?, finding_ids?, format?})Re-read findings from a prior scan_project call, filtered by severity or by finding_ids (the full record of just those findings).
prove({finding_id? | file?, line?, scan_id? | path?})The hop-by-hop proof chain for one finding, with its reachability verdict and exploitability grade. An empty chain means unproven, never safe.
explain({rule_id})Markdown explanation of a rule ID. Accepts OWASP-category slugs, MCP-001..MCP-006, EXT-001..EXT-003, and SUP-COMPROMISE-001..SUP-COMPROMISE-005.
list_rules()Enumerate every rule from the canonical catalogue.
suggest_fixes({scan_id, finding_id?, rule?, verify?})Git-apply-ready fix suggestions for a prior scan, plus remedies whose patches are re-scanned on a temporary copy for a fixed / not-fixed / regressed verdict. Vulkro never applies the diff itself.
verify_fix({diff, path? | scan_id?, finding_id?})Apply a proposed unified diff to a temporary copy, re-scan, and return fixed, not-fixed or regressed. The working tree is never modified.
verify_sarif({sarif, path})Check another tool's SARIF 2.1.0 results against Vulkro's proof: each result is proven, not-provable or not-examined.
inspect_repo({path})Vulkro Inspect as a pre-run check for a just-cloned repository. Surfaces malicious-capability shapes grouped by capability, with file and line per site, over the full unfiltered finding set.
scan_diff({path, base_ref?})Scan the project and return only the findings on the lines a git diff added or modified against base_ref (default HEAD~1). It scans the changed lines; it does not compare two scans.
assess_change({path, symbol?, base?})Before an edit: a symbol's blast radius, tests and findings. After an edit: the diff's dependents, tests and new findings, with a verdict.
code_graph({path, mode?, symbol?, query?, format?, ...})Scan-free, cached code graph: a ranked symbol map, every usage of a name with its code (search), one function's source (body), blast radius, callers and callees. Code structure only.
from_trace({path, trace})Map a stack trace's file:line frames to symbols, with their findings and blast radius.
evidence_graph({path, repo_name?})The evidence-graph/1.0 document for a project: endpoints with route-shape and auth tier, outbound calls, taint flows, findings with reachability verdicts, dependency evidence.
aggregate({graphs})Link two or more evidence-graph documents to surface cross-repo edges. Same linker as vulkro aggregate.

Without an active trial or Pro, every scan tool returns JSON-RPC error -32001 with license_required and a message that says how to start the trial and sign in, never an empty result. The server keeps running. See Without a licence.

inspect_repo is a human-review surface, not a gate. It never certifies code safe, clean, or trusted, and returns no proceed / allow / approve verdict. Every response carries a top-level disclaimer.

Transport​

stdio by default: line-delimited JSON-RPC 2.0 over stdin / stdout, the transport every major MCP host uses. Pass --port N to expose an SSE transport on 127.0.0.1:N instead.

vulkro mcp serve              # stdio (default)
vulkro mcp serve --port 9100  # SSE on http://127.0.0.1:9100/sse

Client configuration​

Claude Code:

claude mcp add vulkro -- vulkro mcp serve

Claude Desktop (claude_desktop_config.json), and the same shape for Cursor's ~/.cursor/mcp.json:

{
  "mcpServers": {
    "vulkro": {
      "command": "vulkro",
      "args": ["mcp", "serve"]
    }
  }
}

Codex uses the Vulkro skill instead (see Claude Code skill). Setup for every host is on the vulkro mcp serve page.

Environment variables​

VariableEffect
VULKRO_MCP_LOG=1Emit per-request trace lines on stderr. Off by default so the stdio JSON-RPC stream stays clean.
VULKRO_OFFLINE=1Disable any outbound HTTP call during scans triggered through the MCP surface (same semantics as the top-level scan subcommand).

Exit codes​

  • 0 clean shutdown (the host closed stdin, or Ctrl-C was hit in SSE mode).
  • 1 the server started but a tool call was refused (for example license_required) and the caller treated it as fatal.
  • 2 operational error: bind failure, transport-level IO error, or a bad argument to mcp serve.
Last updated on