Prototyp · Vorschau: alle Server aus der offiziellen Registry, alle 30 Minuten synchronisiert. Bewertungen und Benutzerkonten folgen in einem späteren Schritt.
PopNx MCPMCP-Server für alle, die KI nutzen · in einfachen Worten erklärt
Einsteigermodus Aus
FarbenSystemHellDunkel
SpracheไทยEnglish中文日本語한국어EspañolDeutsch
☰ MenüEinstellungen
Einsteigermodus Aus
FarbenSystemHellDunkel
SpracheไทยEnglish中文日本語한국어EspañolDeutsch

VulKill Security

von dytredlineVersion 1.2.1i★ –iLäuft in der Cloud
Name in der Registryio.github.dytredline/vulkill-security

Installieren

Überblick

Beschreibung vom Entwickler (englisches Original)

Autonomous AppSec & DAST scanner across 12 security domains (260+ controls) with 3-Layer Triage.

Die drei Säulen von PopNx MCP

Diese drei werden nie zu einer Punktzahl zusammengefasst: Meinungen, Messungen und Beliebtheit sind verschiedene Dinge.

Was du damit machen kannst

Für diesen Server haben wir noch keine Zusammenfassung in einfacher Sprache geschrieben. Unten stehen die Fakten, die wir aus der Registry gelesen haben.

  • Verbindung: Läuft in der Cloud
  • Transport: Streamable HTTP
  • Kategorie: Sonstiges

Installation

Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.

Bevor du installierst

  • Basischecks: 3 von 3 bestanden
  • Läuft auf dem Server des Entwicklers: Was du fragst, läuft über dessen Server.
  • Kann 12 Dinge (Tools) vulkill_check_credits, vulkill_wallet_status, vulkill_credit_usage, vulkill_estimate_scan …
  • Die Registry nennt keinen Schlüssel zum Eintragen.

Du brauchst

Welche App nutzt du?

Wähle oben deine App. Wir merken sie uns, damit der Button beim nächsten Mal „In … installieren“ anzeigt.

Funktioniert in Claude im Web, auf dem Desktop und auf dem Handy:

  1. Öffne Settings → Connectors
  2. Tippe auf Add custom connector
  3. Füge die Adresse unten ein und tippe auf Add
  4. Wenn eine Anmeldung verlangt wird, melde dich beim Dienst des Entwicklers an
SettingsConnectors1+ Add2https://…3
https://app.vulkill.com/api/mcp

Führe das in deinem Terminal aus

claude mcp add --transport http vulkill-security https://app.vulkill.com/api/mcp

In Cursor öffnen

Oder kopier die Einstellungen selbst

In .cursor/mcp.json in deinem Projekt oder in ~/.cursor/mcp.json einfügen

{
  "mcpServers": {
    "vulkill-security": {
      "url": "https://app.vulkill.com/api/mcp"
    }
  }
}

Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.

In VS Code öffnen

Oder kopier die Einstellungen selbst

In .vscode/mcp.json in deinem Projekt einfügen

{
  "servers": {
    "vulkill-security": {
      "type": "http",
      "url": "https://app.vulkill.com/api/mcp"
    }
  }
}

Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.

ChatGPT verbindet sich nur mit Servern im Internet:

  1. Öffne ChatGPT im Web → Settings → Connectors (Apps)
  2. Tippe auf Create oder Add (bei manchen Tarifen musst du zuerst Developer mode unter Advanced einschalten)
  3. Füge die Adresse unten ein, gib ihr einen Namen und speichere
  4. Wenn eine Anmeldung verlangt wird, melde dich beim Dienst des Entwicklers an
SettingsConnectors1+ Create2https://…3
https://app.vulkill.com/api/mcp

Menünamen können sich je nach Tarif und mit der Zeit leicht unterscheiden.

Deine Auswahl bleibt in einem Cookie auf diesem Gerät; kein Konto nötig.

Diese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.

Was er kann

Tool-Namen und -Beschreibungen genau so, wie der Server sie am 6. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.

  • vulkill_check_credits

    Tarama öncesi yetki kapsamlarını, beyan metnini, dosya/site kredisini ve süre sınırlarını getirir. Yalnız sayısal bakiye ve motor hazırlığı için vulkill_wallet_status, geçmiş için vulkill_credit_usage kullanın. Tarama başlatmaz; kredi harcamaz.

  • vulkill_wallet_status

    Hesabın remainingFiles, remainingSites, executionAvailable ve dönem bakiyesini getirir. Güncel bakiye için kullanın; geçmiş kullanım için vulkill_credit_usage. executionAvailable tamamlanmış tarama kanıtı değildir. Tarama başlatmaz; kredi harcamaz.

  • vulkill_credit_usage

    Güncel dönemin kredi kullanımını ve en son görev özetlerini getirir. view uyumluluk alanıdır; historical seçimi geçmiş dönem bakiyesi sorgulamaz. Anlık bakiye için vulkill_wallet_status kullanın. Kredi harcamaz.

  • vulkill_estimate_scan

    Dosya ve site sayısından kredi kapsamı ve işçi sınıflarının tahminini oluşturur. Bu yalnız tahmindir; kaynaklar gönderilmez ve görev başlamaz. 5.000 dosya üzerindeki çoklu işçi dağıtımı henüz desteklenmiyor. Kredi harcamaz.

  • vulkill_ai_guide

    Yeni bağlantıda önce bu aracı kullanın: API/MCP akışını, tarama modlarını, hedef doğrulamasını ve kullanıcı yetki beyanını açıklar. Sonraki adım bakiye için vulkill_wallet_status, özellik araması için vulkill_capabilities. Tarama başlatmaz; kredi harcamaz.

  • vulkill_capabilities

    12 güvenlik alanını, 260 kontrolün katalog kapsamını ve 5 tarama modunu açıklar. Boş query özet getirir; query=all tüm 260 maddeyi; mod adı, VK-001, SQL veya CWE-89 ayrıntılı eşleşmeleri getirir. Modlar 3 yetki beyanından ayrıdır. Çalıştırılan kontroller için görev raporunu okuyu

  • vulkill_start_scan

    Yeni istemciler için birincil tarama başlatma aracı. Kaynak dosyalarını sourceFiles içinde veya sahipliği doğrulanmış HTTPS hedefini targetUrl içinde gönderin; yerel yol ve GitHub depo adresi dosya içeriğinin yerine geçmez. authorizationScope seçimi ve kullanıcının açık liability

  • vulkill_auto_scan

    Eski istemciler için tarama başlatma uyumluluk aracı; yeni entegrasyonlarda vulkill_start_scan tercih edin. Aynı yetki/kredi/motor kontrollerini kullanır. sourceFiles veya inline_files ile içerik; targetUrl veya tek dast_targets ile doğrulanmış HTTPS hedefi gönderilir. Yerel proj

  • vulkill_get_scan_status

    vulkill_start_scan sonucundaki scanId için yetkili motordan durum ve rapor günceller. Yeni tarama başlatmaz. Motor başlamadığını doğrularsa ayrılmış kredi uzlaştırılır; zaman aşımı tek başına iade kanıtı değildir. Bulunmayan kimlik not_found, başka hesaba ait kimlik forbidden dön

  • vulkill_list_reports

    Yalnız bağlı hesaba ait en yeni 50 görev ve ayrıntılı findings/coverage/summary raporlarını listeler. Tarama başlatmaz ve yeni kredi harcamaz. Bir görevi motordan güncellemek için vulkill_get_scan_status; bilinen rapor kimliğini okumak için fetch kullanın.

  • search

    Bağlı hesabın raporları ve güvenlik yetenek kataloğunda düz metin query ile arama yapar; örnek: SQL veya CWE-89. Dönen kimliği fetch ile açın. Tüm raporların listesi için vulkill_list_reports kullanın. Yeni tarama başlatmaz; kredi harcamaz.

  • fetch

    search veya vulkill_list_reports sonucundaki id ile hesabınıza ait kayıtlı raporu ya da cap- önekli yetenek kaydını getirir. Yeni tarama başlatmaz; kredi harcamaz. Çalışan görevin durumunu güncellemek için vulkill_get_scan_status kullanın. Bulunmayan ya da erişilemeyen kayıt hata

Basischecksi

Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 7. Nov. 2026

  • ✓ Bestanden

    Entwickler passt zum Repo

    Der Registry-Name wurde mit dem GitHub-Konto dytredline bestätigt, dem das Repo gehört

  • … Noch nicht geprüft

    Wird noch gepflegt

    Dieses Repo haben wir noch nicht von GitHub gelesen

  • … Noch nicht geprüft

    Hat eine Lizenz

    Dieses Repo haben wir noch nicht von GitHub gelesen

  • ✓ Bestanden

    Endpunkt antwortet

    Antwort in 246 ms (HTTP 200)

  • – Nicht zutreffend

    Anmeldung mit OAuth

    Keine Anmeldung nötig

  • ✓ Bestanden

    Keine versteckten Anweisungen in Tool-Beschreibungen

    Wir haben 12 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden

Im Vergleich mit anderen in Sonstigesi

  • Mehr Sterne als 0 % der anderen 32589 Server in dieser Kategorie
  • Neuer in der Registry veröffentlicht als 90 % der anderen 32589 Server in dieser Kategorie
  • Basischecks gleich gut wie oder besser als bei 100 % der anderen 32589 Server in dieser Kategorie

Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.

Häufige Fragen

Ist VulKill Security sicher?

Er hat 3 von 3 zutreffenden Basischecks bestanden. Den Code haben wir nicht gelesen. Bevor du einen Schlüssel oder Token hinzufügst, sieh nach, welche Zugriffe der Server verlangt, und nutze einen Schlüssel, der nur die Berechtigungen hat, die du brauchst.

Welche Schlüssel oder Codes braucht er?

Die Registry nennt keinen erforderlichen Schlüssel, manche Server bitten dich aber bei der ersten Nutzung, dich anzumelden.

Läuft er auf meinem Computer oder in der Cloud?

Er läuft in der Cloud des Entwicklers. Du verbindest dich übers Internet, ohne etwas zu installieren, aber was du sendest, läuft über die Server des Entwicklers.

Wird er noch gepflegt?

Das GitHub-Repo wurde zuletzt – geändert, und die neueste Version (1.2.1) kam vor 3 Tagen in die Registry.

Welche Apps können ihn nutzen?

Apps, die MCP unterstützen, etwa Claude Desktop, Claude Code, Cursor und VS Code. Er verbindet sich per URL, also funktionieren auch Apps, die Remote-MCP-Server akzeptieren, zum Beispiel ChatGPT im Entwicklermodus.

Was kann ich stattdessen nutzen?

In derselben Kategorie: Spec Driven Development, Remote Desktop Commander, Detailing Manager

Alternativen

Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.

So liest du eine Karte:★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti

Spec Driven Development

von formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Läuft auf deinem Computer★ 440MITAktualisiert vor 14 Monaten
Installieren

Remote Desktop Commander

von desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Läuft in der Cloud★ 211Aktualisiert gestern
Installieren

Detailing Manager

von RadoslavMoshev

Connect your auto detailing studio's tasks, cars, clients and revenue to Claude or ChatGPT.

Läuft auf deinem ComputerAktualisiert heute
Installieren

README vom Entwickler

README öffnen

Unverändert aus dem Repo des Entwicklers übernommen. PopNx MCP hat den Inhalt weder geprüft noch empfiehlt es ihn. HTML, Bilder und Skripte wurden entfernt. Links führen von dieser Website weg.

VulKill Community

English | Türkçe | 日本語 | 简体中文 | 한국어

VulKill website · Project overview at ConverserAI · Capabilities · Setup · Frequently asked questions

VulKill Community is an open-source, local-first defensive application-security toolkit for people who build, own, or review applications, APIs, and websites. It helps teams examine supported source code through static application security testing (SAST), dependency manifests and SBOMs for software composition analysis (SCA), container artifacts, infrastructure as code (IaC), CI configuration, and saved security reports. For an owned or explicitly authorized web target, VulKill can also prepare a bounded runtime action for human review. Results are available to an AI client over local stdio MCP, to a person through the CLI, or in the loopback web interface.

Capability tags

Application Security · SAST · SCA · SBOM · IaC Security · API Security · Website Security · Mobile Security · Android · iOS · IDOR · Authorization · GraphQL · Kubernetes · SLSA · MCP · SARIF · OpenVEX · GHSA · CVSS · SSVC · DevSecOps

VulKill Community v1.1 adds deeper, reviewable coverage in these areas:

  • Cross-framework access control: correlate supported routes, resolvers, policies, roles, owners, and tenant-bound queries.
  • Multi-repository security graphs: map supported API, webhook, event, authentication, dependency, and CI trust relationships.
  • Bounded runtime evidence: prepare reviewable fuzz and runtime workflows with explicit prerequisites and resource limits.
  • Supply-chain and platform review: inspect supported provenance, SBOM/VEX, container, Kubernetes, IaC, CI/CD, and migration signals.
  • AI-assisted defensive workflows: expose review and remediation helpers over local stdio MCP while keeping effective actions approval-bound.
  • Evidence-based prioritization: connect supported findings to SARIF flows, reachability, attack paths, CVSS, SSVC, and remediation gates.

Review before you ship

Ask an AI assistant to review your application before release. Through VulKill's local stdio MCP workflow, the AI can guide a supported security review, explain findings with code evidence, and help prioritize remediation while the same results remain available in the web interface, CLI, and CI artifacts.

For Android, iOS, Flutter, and React Native projects, bring supported source code, mobile manifests, API paths, secrets, dependencies, SBOM data, and CI configuration into one release-preflight view. Whether you are preparing an App Store or Google Play submission, a website or API launch, or a pull request, VulKill helps surface the security work worth completing before users receive the release.

What VulKill helps you inspect

AreaQuestions VulKill helps answer
Source code and configurationWhich supported code paths, security patterns, secrets, and configuration choices need human review?
Authorization and IDOR reviewWhich supported Python, JavaScript/TypeScript, Ruby/Rails, Spring, or ASP.NET routes may lack an authorization check (CWE-862), or load an object identifier without a visible user/role binding and therefore need IDOR review (CWE-639)? Rails analysis correlates cross-file controller inheritance; Spring and ASP.NET analysis correlates literal controller/minimal routes with authorization annotations or policies and subject-bound lookups.
GraphQL resolver authorizationWhich supported GraphQL-Ruby SDL root fields map to method-style or explicit BaseResolver classes that perform an unscoped ActiveRecord object lookup without a visible owner, tenant, or policy guard?
Multi-repository trustWhich selected local repositories are linked by supported OpenAPI calls, webhooks, Kafka topics, explicit auth contracts, GraphQL operations, or exact PyPI pins—and where do static trust/version signals disagree?
Dependencies and SBOMsWhat components are present across supported manifests—including NuGet/Paket and Terraform provider lock selections—how are they related, and what does the available local vulnerability evidence say?
Containers and software supply chainWhat packages, layers, manifests, provenance signals, and risky build choices appear in supported local artifacts?
Infrastructure and CI/CDDo supported Terraform, Kubernetes, Helm, Dockerfile, Compose, cloud IAM, or CI workflow inputs expose known risky settings, including unsafe reusable-workflow permission/secret inheritance or pull-request artifact trust edges?
Saved security reportsCan supported SARIF and tool reports be validated, bounded, summarized, and brought into one review flow?
Authorized website and TLS workflowsWhat exact target, scope, consent, readiness, and stop conditions must a human verify before an external action?

The complete, evidence-linked inventory is in Capabilities and security checks. Practical paths for application, API, website, platform, and security teams are in Use cases. AI systems can start with the compact LLM project index, while people can inspect the latest validation evidence.

Security review highlights

  • Trace high-impact data flows: follow supported source-to-sink paths for SQL and command injection, XSS/HTML, SSRF, open redirect, path traversal, unsafe deserialization, XXE, expression-language, and LDAP risks. Supported flow evidence can travel with SARIF codeFlows for review in development tooling.
  • Focus access-control testing: turn routes, object identifiers, roles, and visible ownership checks into a prioritized list of CWE-862 and IDOR (CWE-639) candidates for authorized manual penetration testing.
  • Find exposed secrets and privacy paths: combine provider patterns and entropy signals with privacy-oriented flows toward logs, responses, storage, and third-party destinations while keeping secret evidence redacted.
  • Understand dependencies and the software supply chain: inventory direct and transitive components, generate or import CycloneDX/SPDX SBOMs, work with VEX, review reachability context, and bring local vulnerability evidence into release decisions. Bulk local review can also correlate unambiguous exact PyPI pins across repositories and report version drift without returning private package-index addresses or credentials.
  • Map service trust across repositories: correlate supported OpenAPI operations, webhook boundaries, literal Kafka topics, explicit authentication contracts, and exact GraphQL query/mutation/subscription root-field pairs across separate repositories, including safe named fragments and SHA-256 verified Apollo persisted operations in one bounded offline bulk result. Optionally correlate an integrity-checked, exact-schema local runtime trace manifest with those static HTTP/webhook/Kafka/GraphQL edges without returning URLs, bodies, tokens, or secrets; missing or invalid trace evidence never removes the static edge.
  • Harden containers, cloud, and delivery pipelines: inspect supported container archives, Dockerfiles, Terraform, Kubernetes, Helm, Compose, cloud IAM, CI workflows, browser extensions, mobile manifests, and desktop-app security configuration from one review surface.
  • Review APIs, websites, and TLS: compare local OpenAPI contracts with source routes, inspect authentication mismatches, evaluate supported web-security signals, and prepare bounded actions for owned or authorized targets.
  • Prioritize the work that matters: enrich findings with CVSS 3.1 and CVSS 4.0, CISA SSVC, attack-path correlation, ownership, due dates, baselines, and quality gates so teams can move from evidence to remediation.
  • Prepare reviewable fuzz targets: synthesize C/C++ LibFuzzer, Rust cargo-fuzz, native Go testing.F, Python Atheris, Java Jazzer, and JavaScript/TypeScript fast-check harness text for a specific local parser or decoder finding. Target resolution binds one supported function or method to its reviewed source and fails closed on ambiguous signatures. Atheris, Jazzer, and fast-check can also run through the explicit local-runtime API when an operator supplies exact runtime/module-or-JAR paths and SHA-256 pins; runs are network-isolated and bounded by seed, run count, input bytes, wall time, output bytes, and process-group cleanup. Optional engines are not bundled or downloaded, and an absent engine remains runtime_missing/not_run rather than simulated evidence; execution remains an explicit operator step.
  • Choose the workflow that fits: use the loopback web interface, scriptable CLI, CI artifacts, or stdio MCP for AI-assisted review, with JSON, HTML, SARIF, GitLab, SBOM, VEX, and supported PDF outputs.

IDOR and manual penetration testing support

VulKill turns supported source code into a focused lead list for authorized manual penetration testing. Its built-in route and authorization inventory can flag unprotected-route candidates (CWE-862) and potential Insecure Direct Object Reference (IDOR) paths (CWE-639), then point the reviewer to the relevant file, route, and line of code. This helps a tester prioritize hands-on checks with separate test users, roles, and synthetic objects instead of starting from an unstructured endpoint list.

Each candidate is packaged for evidence-led manual validation. Within an authorized test scope, reviewers can confirm runtime behavior across separate users and roles while accounting for gateway, middleware, policy-service, and business-logic controls.

VulKill includes built-in analyzers and report parsers in the source tree. Its rootless local profile can additionally install seven pinned, optional third-party engines: Nuclei, Trivy, Gitleaks, TruffleHog, Opengrep, Syft, and Grype. The built-in analysis remains available independently; an optional engine or profile is shown as usable only after its runtime, data, and license readiness checks pass.

The loopback interface and HTML reports use Turkish as the source language and provide an English base pack plus expanded Japanese, Simplified Chinese, and Korean starter packs. A missing CJK entry falls back to English when that entry exists, otherwise the original Turkish source remains. The CJK layouts are exercised in desktop and mobile Chromium viewports. See localization coverage and language-pack updates.

This repository prepares the Community release surface. Enterprise code is not included as a supported Community product surface. Commercial services, hosted operation, support commitments, customer-bound licensing, private installers, and native-delivery implementation are outside the Community scope. The assembled public tree replaces the shared server's small version/backup dependency with a Community-only compatibility module and rejects any reintroduction of the excluded delivery files.

Release status

This repository is the VulKill Community v1.2.1 source release. COMMUNITY_VERSION is the source-version marker; published tags must match it as v . The source is licensed under the Apache License 2.0. See LICENSE. The publication status does not make that license grant provisional.

What is included

  • Local project analysis for supported source, infrastructure, dependency, and container inputs.
  • Six bounded cross-repository graph views for supported HTTP/OpenAPI, webhook, Kafka, auth-contract, GraphQL, and exact PyPI dependency evidence. Each graph fails closed independently so one unavailable correlation does not erase the others.
  • Cross-file GitHub Actions

Nur der Anfang wird gezeigt; den Rest findest du im Repo

PopNx fragen