Prototype · Preview: every server in the official registry, synced every 30 minutes. Reviews and accounts come in a later step.
PopNx MCPMCP servers for people who use AI · explained in plain words
Beginner mode Off
ColoursSystemLightDark
LanguageไทยEnglish中文日本語한국어EspañolDeutsch
☰ MenuSettings
Beginner mode Off
ColoursSystemLightDark
LanguageไทยEnglish中文日本語한국어EspañolDeutsch

VulKill Security

by dytredlineversion 1.2.1i★ –iRuns in the cloud
Registry nameio.github.dytredline/vulkill-security

Install

Overview

Description from the maker (original English)

Autonomous AppSec & DAST scanner across 12 security domains (260+ controls) with 3-Layer Triage.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Install

Pick the AI app you use, then copy the settings.

Before you install

  • Basic checks: 3 of 3 passed
  • Runs on the maker’s server: what you ask it goes through their server.
  • Can do 12 things (tools) vulkill_check_credits, vulkill_wallet_status, vulkill_credit_usage, vulkill_estimate_scan …
  • The registry lists no key to fill in.

You need

Which app do you use?

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

  1. Open Settings → Connectors
  2. Press Add custom connector
  3. Paste the address below and press Add
  4. If it asks you to sign in, sign in with the maker
SettingsConnectors1+ Add2https://…3
https://app.vulkill.com/api/mcp

Run this in your terminal

claude mcp add --transport http vulkill-security https://app.vulkill.com/api/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "vulkill-security": {
      "url": "https://app.vulkill.com/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "vulkill-security": {
      "type": "http",
      "url": "https://app.vulkill.com/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

  1. Open ChatGPT on the web → Settings → Connectors (Apps)
  2. Press Create or Add (some plans need Developer mode under Advanced first)
  3. Paste the address below, give it a name and save
  4. If it asks you to sign in, sign in with the maker
SettingsConnectors1+ Create2https://…3
https://app.vulkill.com/api/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

  • vulkill_check_credits

    Tarama öncesi yetki kapsamlarını, beyan metnini, dosya/site kredisini ve süre sınırlarını getirir. Yalnız sayısal bakiye ve motor hazırlığı için vulkill_wallet_status, geçmiş için vulkill_credit_usage kullanın. Tarama başlatmaz; kredi harcamaz.

  • vulkill_wallet_status

    Hesabın remainingFiles, remainingSites, executionAvailable ve dönem bakiyesini getirir. Güncel bakiye için kullanın; geçmiş kullanım için vulkill_credit_usage. executionAvailable tamamlanmış tarama kanıtı değildir. Tarama başlatmaz; kredi harcamaz.

  • vulkill_credit_usage

    Güncel dönemin kredi kullanımını ve en son görev özetlerini getirir. view uyumluluk alanıdır; historical seçimi geçmiş dönem bakiyesi sorgulamaz. Anlık bakiye için vulkill_wallet_status kullanın. Kredi harcamaz.

  • vulkill_estimate_scan

    Dosya ve site sayısından kredi kapsamı ve işçi sınıflarının tahminini oluşturur. Bu yalnız tahmindir; kaynaklar gönderilmez ve görev başlamaz. 5.000 dosya üzerindeki çoklu işçi dağıtımı henüz desteklenmiyor. Kredi harcamaz.

  • vulkill_ai_guide

    Yeni bağlantıda önce bu aracı kullanın: API/MCP akışını, tarama modlarını, hedef doğrulamasını ve kullanıcı yetki beyanını açıklar. Sonraki adım bakiye için vulkill_wallet_status, özellik araması için vulkill_capabilities. Tarama başlatmaz; kredi harcamaz.

  • vulkill_capabilities

    12 güvenlik alanını, 260 kontrolün katalog kapsamını ve 5 tarama modunu açıklar. Boş query özet getirir; query=all tüm 260 maddeyi; mod adı, VK-001, SQL veya CWE-89 ayrıntılı eşleşmeleri getirir. Modlar 3 yetki beyanından ayrıdır. Çalıştırılan kontroller için görev raporunu okuyu

  • vulkill_start_scan

    Yeni istemciler için birincil tarama başlatma aracı. Kaynak dosyalarını sourceFiles içinde veya sahipliği doğrulanmış HTTPS hedefini targetUrl içinde gönderin; yerel yol ve GitHub depo adresi dosya içeriğinin yerine geçmez. authorizationScope seçimi ve kullanıcının açık liability

  • vulkill_auto_scan

    Eski istemciler için tarama başlatma uyumluluk aracı; yeni entegrasyonlarda vulkill_start_scan tercih edin. Aynı yetki/kredi/motor kontrollerini kullanır. sourceFiles veya inline_files ile içerik; targetUrl veya tek dast_targets ile doğrulanmış HTTPS hedefi gönderilir. Yerel proj

  • vulkill_get_scan_status

    vulkill_start_scan sonucundaki scanId için yetkili motordan durum ve rapor günceller. Yeni tarama başlatmaz. Motor başlamadığını doğrularsa ayrılmış kredi uzlaştırılır; zaman aşımı tek başına iade kanıtı değildir. Bulunmayan kimlik not_found, başka hesaba ait kimlik forbidden dön

  • vulkill_list_reports

    Yalnız bağlı hesaba ait en yeni 50 görev ve ayrıntılı findings/coverage/summary raporlarını listeler. Tarama başlatmaz ve yeni kredi harcamaz. Bir görevi motordan güncellemek için vulkill_get_scan_status; bilinen rapor kimliğini okumak için fetch kullanın.

  • search

    Bağlı hesabın raporları ve güvenlik yetenek kataloğunda düz metin query ile arama yapar; örnek: SQL veya CWE-89. Dönen kimliği fetch ile açın. Tüm raporların listesi için vulkill_list_reports kullanın. Yeni tarama başlatmaz; kredi harcamaz.

  • fetch

    search veya vulkill_list_reports sonucundaki id ile hesabınıza ait kayıtlı raporu ya da cap- önekli yetenek kaydını getirir. Yeni tarama başlatmaz; kredi harcamaz. Çalışan görevin durumunu güncellemek için vulkill_get_scan_status kullanın. Bulunmayan ya da erişilemeyen kayıt hata

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

  • ✓ Pass

    Maker matches the repo

    The registry name was verified with the GitHub account dytredline, which owns the repo

  • … Not checked yet

    Still maintained

    We have not read this repo from GitHub yet

  • … Not checked yet

    Has a licence

    We have not read this repo from GitHub yet

  • ✓ Pass

    Endpoint responds

    Responded in 246 ms (HTTP 200)

  • – Not applicable

    Sign-in with OAuth

    No sign-in needed

  • ✓ Pass

    No hidden instructions in tool descriptions

    Read 12 tool descriptions and found no hidden instructions to the AI

Compared with others in Otheri

  • More stars than 0% of the other 32706 servers in this category
  • Published to the registry more recently than 89% of the other 32706 servers in this category
  • Basic checks equal to or better than 100% of the other 32706 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is VulKill Security safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.2.1) reached the registry 4 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Kanal Varna — drains, leaks & plumbing (Varna, BG)

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago
Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago
Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

VulKill Community

English | Türkçe | 日本語 | 简体中文 | 한국어

VulKill website · Project overview at ConverserAI · Capabilities · Setup · Frequently asked questions

VulKill Community is an open-source, local-first defensive application-security toolkit for people who build, own, or review applications, APIs, and websites. It helps teams examine supported source code through static application security testing (SAST), dependency manifests and SBOMs for software composition analysis (SCA), container artifacts, infrastructure as code (IaC), CI configuration, and saved security reports. For an owned or explicitly authorized web target, VulKill can also prepare a bounded runtime action for human review. Results are available to an AI client over local stdio MCP, to a person through the CLI, or in the loopback web interface.

Capability tags

Application Security · SAST · SCA · SBOM · IaC Security · API Security · Website Security · Mobile Security · Android · iOS · IDOR · Authorization · GraphQL · Kubernetes · SLSA · MCP · SARIF · OpenVEX · GHSA · CVSS · SSVC · DevSecOps

VulKill Community v1.1 adds deeper, reviewable coverage in these areas:

  • Cross-framework access control: correlate supported routes, resolvers, policies, roles, owners, and tenant-bound queries.
  • Multi-repository security graphs: map supported API, webhook, event, authentication, dependency, and CI trust relationships.
  • Bounded runtime evidence: prepare reviewable fuzz and runtime workflows with explicit prerequisites and resource limits.
  • Supply-chain and platform review: inspect supported provenance, SBOM/VEX, container, Kubernetes, IaC, CI/CD, and migration signals.
  • AI-assisted defensive workflows: expose review and remediation helpers over local stdio MCP while keeping effective actions approval-bound.
  • Evidence-based prioritization: connect supported findings to SARIF flows, reachability, attack paths, CVSS, SSVC, and remediation gates.

Review before you ship

Ask an AI assistant to review your application before release. Through VulKill's local stdio MCP workflow, the AI can guide a supported security review, explain findings with code evidence, and help prioritize remediation while the same results remain available in the web interface, CLI, and CI artifacts.

For Android, iOS, Flutter, and React Native projects, bring supported source code, mobile manifests, API paths, secrets, dependencies, SBOM data, and CI configuration into one release-preflight view. Whether you are preparing an App Store or Google Play submission, a website or API launch, or a pull request, VulKill helps surface the security work worth completing before users receive the release.

What VulKill helps you inspect

AreaQuestions VulKill helps answer
Source code and configurationWhich supported code paths, security patterns, secrets, and configuration choices need human review?
Authorization and IDOR reviewWhich supported Python, JavaScript/TypeScript, Ruby/Rails, Spring, or ASP.NET routes may lack an authorization check (CWE-862), or load an object identifier without a visible user/role binding and therefore need IDOR review (CWE-639)? Rails analysis correlates cross-file controller inheritance; Spring and ASP.NET analysis correlates literal controller/minimal routes with authorization annotations or policies and subject-bound lookups.
GraphQL resolver authorizationWhich supported GraphQL-Ruby SDL root fields map to method-style or explicit BaseResolver classes that perform an unscoped ActiveRecord object lookup without a visible owner, tenant, or policy guard?
Multi-repository trustWhich selected local repositories are linked by supported OpenAPI calls, webhooks, Kafka topics, explicit auth contracts, GraphQL operations, or exact PyPI pins—and where do static trust/version signals disagree?
Dependencies and SBOMsWhat components are present across supported manifests—including NuGet/Paket and Terraform provider lock selections—how are they related, and what does the available local vulnerability evidence say?
Containers and software supply chainWhat packages, layers, manifests, provenance signals, and risky build choices appear in supported local artifacts?
Infrastructure and CI/CDDo supported Terraform, Kubernetes, Helm, Dockerfile, Compose, cloud IAM, or CI workflow inputs expose known risky settings, including unsafe reusable-workflow permission/secret inheritance or pull-request artifact trust edges?
Saved security reportsCan supported SARIF and tool reports be validated, bounded, summarized, and brought into one review flow?
Authorized website and TLS workflowsWhat exact target, scope, consent, readiness, and stop conditions must a human verify before an external action?

The complete, evidence-linked inventory is in Capabilities and security checks. Practical paths for application, API, website, platform, and security teams are in Use cases. AI systems can start with the compact LLM project index, while people can inspect the latest validation evidence.

Security review highlights

  • Trace high-impact data flows: follow supported source-to-sink paths for SQL and command injection, XSS/HTML, SSRF, open redirect, path traversal, unsafe deserialization, XXE, expression-language, and LDAP risks. Supported flow evidence can travel with SARIF codeFlows for review in development tooling.
  • Focus access-control testing: turn routes, object identifiers, roles, and visible ownership checks into a prioritized list of CWE-862 and IDOR (CWE-639) candidates for authorized manual penetration testing.
  • Find exposed secrets and privacy paths: combine provider patterns and entropy signals with privacy-oriented flows toward logs, responses, storage, and third-party destinations while keeping secret evidence redacted.
  • Understand dependencies and the software supply chain: inventory direct and transitive components, generate or import CycloneDX/SPDX SBOMs, work with VEX, review reachability context, and bring local vulnerability evidence into release decisions. Bulk local review can also correlate unambiguous exact PyPI pins across repositories and report version drift without returning private package-index addresses or credentials.
  • Map service trust across repositories: correlate supported OpenAPI operations, webhook boundaries, literal Kafka topics, explicit authentication contracts, and exact GraphQL query/mutation/subscription root-field pairs across separate repositories, including safe named fragments and SHA-256 verified Apollo persisted operations in one bounded offline bulk result. Optionally correlate an integrity-checked, exact-schema local runtime trace manifest with those static HTTP/webhook/Kafka/GraphQL edges without returning URLs, bodies, tokens, or secrets; missing or invalid trace evidence never removes the static edge.
  • Harden containers, cloud, and delivery pipelines: inspect supported container archives, Dockerfiles, Terraform, Kubernetes, Helm, Compose, cloud IAM, CI workflows, browser extensions, mobile manifests, and desktop-app security configuration from one review surface.
  • Review APIs, websites, and TLS: compare local OpenAPI contracts with source routes, inspect authentication mismatches, evaluate supported web-security signals, and prepare bounded actions for owned or authorized targets.
  • Prioritize the work that matters: enrich findings with CVSS 3.1 and CVSS 4.0, CISA SSVC, attack-path correlation, ownership, due dates, baselines, and quality gates so teams can move from evidence to remediation.
  • Prepare reviewable fuzz targets: synthesize C/C++ LibFuzzer, Rust cargo-fuzz, native Go testing.F, Python Atheris, Java Jazzer, and JavaScript/TypeScript fast-check harness text for a specific local parser or decoder finding. Target resolution binds one supported function or method to its reviewed source and fails closed on ambiguous signatures. Atheris, Jazzer, and fast-check can also run through the explicit local-runtime API when an operator supplies exact runtime/module-or-JAR paths and SHA-256 pins; runs are network-isolated and bounded by seed, run count, input bytes, wall time, output bytes, and process-group cleanup. Optional engines are not bundled or downloaded, and an absent engine remains runtime_missing/not_run rather than simulated evidence; execution remains an explicit operator step.
  • Choose the workflow that fits: use the loopback web interface, scriptable CLI, CI artifacts, or stdio MCP for AI-assisted review, with JSON, HTML, SARIF, GitLab, SBOM, VEX, and supported PDF outputs.

IDOR and manual penetration testing support

VulKill turns supported source code into a focused lead list for authorized manual penetration testing. Its built-in route and authorization inventory can flag unprotected-route candidates (CWE-862) and potential Insecure Direct Object Reference (IDOR) paths (CWE-639), then point the reviewer to the relevant file, route, and line of code. This helps a tester prioritize hands-on checks with separate test users, roles, and synthetic objects instead of starting from an unstructured endpoint list.

Each candidate is packaged for evidence-led manual validation. Within an authorized test scope, reviewers can confirm runtime behavior across separate users and roles while accounting for gateway, middleware, policy-service, and business-logic controls.

VulKill includes built-in analyzers and report parsers in the source tree. Its rootless local profile can additionally install seven pinned, optional third-party engines: Nuclei, Trivy, Gitleaks, TruffleHog, Opengrep, Syft, and Grype. The built-in analysis remains available independently; an optional engine or profile is shown as usable only after its runtime, data, and license readiness checks pass.

The loopback interface and HTML reports use Turkish as the source language and provide an English base pack plus expanded Japanese, Simplified Chinese, and Korean starter packs. A missing CJK entry falls back to English when that entry exists, otherwise the original Turkish source remains. The CJK layouts are exercised in desktop and mobile Chromium viewports. See localization coverage and language-pack updates.

This repository prepares the Community release surface. Enterprise code is not included as a supported Community product surface. Commercial services, hosted operation, support commitments, customer-bound licensing, private installers, and native-delivery implementation are outside the Community scope. The assembled public tree replaces the shared server's small version/backup dependency with a Community-only compatibility module and rejects any reintroduction of the excluded delivery files.

Release status

This repository is the VulKill Community v1.2.1 source release. COMMUNITY_VERSION is the source-version marker; published tags must match it as v . The source is licensed under the Apache License 2.0. See LICENSE. The publication status does not make that license grant provisional.

What is included

  • Local project analysis for supported source, infrastructure, dependency, and container inputs.
  • Six bounded cross-repository graph views for supported HTTP/OpenAPI, webhook, Kafka, auth-contract, GraphQL, and exact PyPI dependency evidence. Each graph fails closed independently so one unavailable correlation does not erase the others.
  • Cross-file GitHub Actions

Only the beginning is shown; read the rest in the repo

Ask PopNx