tools/security/vuln_scanner

newsecurityv0.1.0free

fizzgig__vuln_scanner

known-cve lookup against osv.dev for npm packages. closes the gap dep-audit (structural) leaves open.

Queries the OSV.dev advisory database (which aggregates GitHub Security Advisories, npm advisories, and CVE/NVD entries) for known vulnerabilities affecting your installed packages. Returns one finding per affected package with vulns[] inside, headline severity = worst across the package, and upgrade_to = lowest fixed version — surface that as the headline remediation. Pairs with dep-audit (structural risk) and secret-leak-finder (your own credentials) — a clean run across all three is a green light to deploy.

● new● v0.1.0● free

// input schema

schema · application/json

{

"type": "object"

"required": [

"project"

]

"properties": {

"project": {

"type": "string"

"description": "the project slug or path"

}

"strict": {

"type": "boolean"

"default": false

"description": "fail on warnings, not just errors"

}

// output schema

schema · application/json

{

"type": "object"

"properties": {

"ok": {

"type": "boolean"

}

"findings": {

"type": "array"

"items": {

"type": "object"

"properties": {

"severity": {

"enum": [

"info"

"warn"

"high"

"critical"

]

}

"message": {

"type": "string"

}

"fix": {

"type": "string"

}

// example call from cursor

~/myapp — example output

→ fizzgig__vuln_scanner(project="myapp")

{

"ok": false,

"findings": [

{ "severity": "high",

"message": "policy uses user_id without auth.uid()",

"fix": "USING (auth.uid() = user_id)" }

"scanned": 3, "duration_ms": 142

}

// reviews

@maya.codes★★★★★

2 days ago

caught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.

@solo_at_3am★★★★★

1 week ago

first tool i installed. it's the one that pays for itself.

@vibebuilder★★★★☆

2 weeks ago

works great. one false positive on a join table — easy to ignore.

// primary action

add to your editor

paste this into your mcp config.

.cursor/mcp.json

{
  "fizzgig": {
    "url": "https://mcp.fizzgig.ai",
    "tools": ["vuln_scanner"]
  }
}

full setup guide →

// pricing

free

unlimited calls on the free tier.

// related tools