Valca

Name: Valca
Author: PranLabs

by PranLabsversion 0.6.1i★ –iRuns on your computer

Registry nameio.github.pranlabs/valca

Install

Overview

Description from the maker (original English)

Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "valca": {
      "command": "uvx",
      "args": [
        "valca"
      ]
    }
  }
}

Run this in your terminal

claude mcp add valca -- uvx valca

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "valca": {
      "command": "uvx",
      "args": [
        "valca"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "valca": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "valca"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account PranLabs, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32602 servers in this category
Published to the registry more recently than 57% of the other 32602 servers in this category
Basic checks equal to or better than 100% of the other 32602 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Valca safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.6.1) reached the registry 31 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Rystic

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Rystic

by Rystic-Inc

Start, seed, clock, inspect and diff Rystic API simulators from your agent.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Valca

AI coding security co-pilot — blocks insecure code at the moment of generation.

Formerly published as `vigilsec`. The package is now valca. Both the valca and vigil

commands work, so existing hooks and scripts keep running unchanged.

Valca intercepts every file an AI coding assistant writes and blocks it if CRITICAL or HIGH security findings are detected — before the file hits disk. It's the only tool that operates at generation time rather than post-commit.

AI writes file → valca scan → exit 2 → Claude Code blocks the write

The Problem

AI coding assistants reproduce the most common patterns in their training data. The most common patterns are insecure defaults.

The clearest example: every existing IaC scanner (Checkov, Trivy, Snyk, Semgrep) misses the docker-compose port binding that exposes your database to the internet:

ports:

"5432:5432" # ← binds to 0.0.0.0, bypasses UFW, reachable from anywhere

The correct form is "127.0.0.1:5432:5432". Valca catches it. Nothing else does.

Install

pip install valca

Wire the Claude Code hook (one time):

valca init --global     # `valca init --global` also works

That's it. Every file Claude Code writes is now scanned before it saves. Reload Claude Code to activate.

Network access

Valca's core scanning is fully offline — the package has zero runtime dependencies and the engine never sends your code, file paths, or findings anywhere.

Three rules do reach the network, because checking whether a dependency is vulnerable or fabricated is impossible offline. When a manifest (requirements.txt, package.json, lockfiles) is scanned, these rules send package names and version strings only to:

Host	Used by	What is sent
`api.osv.dev`	VGL-PKG001 (known CVE in a pinned version)	package name + version
`pypi.org`	VGL-PKG002/003/004 (hallucinated, stale, or suspicious package)	package name
`registry.npmjs.org`	VGL-PKG002/003/004	package name

Your source code, file contents, file paths, and scan results are never transmitted. If your dependency inventory is itself sensitive, turn these rules off in .valcarc and Valca runs completely offline:

disabled_rules = ["VGL-PKG001", "VGL-PKG002", "VGL-PKG003", "VGL-PKG004"]

Usage

# Scan a single file

valca scan docker-compose.yml

Scan a directory

valca scan ./my-project/

JSON output (for CI / dashboards)

valca scan ./my-project/ --format json

SARIF output (for GitHub Advanced Security)

valca scan ./my-project/ --format sarif > results.sarif

Only report HIGH and above

valca scan ./my-project/ --severity HIGH

Open feedback & waitlist form

valca feedback

Review what has been caught over time. Both commands read the local scan history — nothing leaves your machine.

# Findings log — what was caught, where, and when

valca log # 20 most recent findings valca log --severity CRITICAL # only criticals valca log --project api --since 2026-09-01 valca log --limit 100 --format json # for dashboards

Aggregate stats — rule frequency, severity mix, precision per rule

valca stats valca stats --format json

valca stats reports how often each rule fires and how often you suppressed it, so rules with poor precision in *your* codebase are visible rather than guessed at.

Exit codes:

Code	Meaning
`0`	No findings — write proceeds
`1`	Advisory findings only (MEDIUM / LOW / INFO)
`2`	CRITICAL or HIGH found — Claude Code blocks the write

See It in Action

Blocking a vulnerable GitHub Actions workflow at write time:

In April 2026, researchers found that all three major AI coding agents (Claude Code, Gemini CLI, Copilot) could be hijacked to exfiltrate ANTHROPIC_API_KEY and GITHUB_TOKEN via a hidden HTML comment in a GitHub issue. CVSS 9.4. No special access required.

Valca catches the vulnerable workflow (issues: trigger + AI agent + API key in env) before it reaches git — the only tool that does.

→ Full writeup: The Attack That Steals Your API Keys Through a GitHub Issue Comment

Rules

116 rules across 27 categories. All built-in, stdlib-only, zero runtime dependencies.

This catalogue is generated from the rule registry — it cannot drift from the shipped engine.

Secrets & Credential Exposure (14 rules)

Rule	Severity	What it catches
VGL-I001	CRITICAL	eval() or exec() — code injection risk
VGL-I002	HIGH	subprocess with shell=True
VGL-I003	HIGH	os.system() call
VGL-S001	CRITICAL	AWS access key hardcoded
VGL-S002	CRITICAL	Hardcoded password
VGL-S003	CRITICAL	Hardcoded API key
VGL-S004	CRITICAL	Hardcoded bearer token
VGL-S005	CRITICAL	Hardcoded JWT secret
VGL-S006	CRITICAL	PEM private key in source
VGL-S007	CRITICAL	Database URL with embedded credentials
VGL-S008	CRITICAL	Stripe live secret key
VGL-S009	CRITICAL	Slack token hardcoded
VGL-S010	CRITICAL	Provider API key hardcoded (OpenAI / GitHub / GitLab / Google)
VGL-S012	HIGH	Insecure placeholder default for security-critical config

GitHub Actions — AI Agent Surface (13 rules)

Rule	Severity	What it catches
VGL-GHA001	CRITICAL	Pwn Request — pull_request_target with attacker-controlled checkout ref
VGL-GHA002	CRITICAL	Script injection — user-controlled context expression in run: step
VGL-GHA004	HIGH	Secret directly interpolated in run: step (visible in process table)
VGL-GHA005	MEDIUM	Workflow missing explicit permissions block (implicit GITHUB_TOKEN scope)
VGL-GHA006	HIGH	Cache usage in pull_request workflow (cache poisoning attack vector)
VGL-GHA007	HIGH	Self-hosted runner with pull_request trigger (persistent runner risk)
VGL-GHA008	HIGH	workflow_run trigger without ref/repo validation
VGL-GHA009	CRITICAL	AI agent wired to untrusted-input trigger (issues/pull_request_target) with API key in env
VGL-GHA010	HIGH	AI agent on pull_request_target without fork origin guard
VGL-GHA011	CRITICAL	Untrusted GitHub event data interpolated into AI agent prompt
VGL-GHA012	HIGH	AI agent on untrusted trigger with no --allowedTools restriction
VGL-GHA013	MEDIUM	AI agent on untrusted trigger with no --max-turns limit
VGL-GHA014	HIGH	contents: write permission with AI agent on untrusted trigger

AI Agent — Prompt Injection (9 rules)

Rule	Severity	What it catches
VGL-PI001	CRITICAL	User input interpolated into the LLM system prompt
VGL-PI002	HIGH	Raw HTTP request body used as LLM message content
VGL-PI003	HIGH	String formatting used to build prompts with user data
VGL-PI004	MEDIUM	Tool output appended to the conversation without sanitization
VGL-PI005	CRITICAL	HTTP request data flows into an LLM prompt unsanitised
VGL-PI006	CRITICAL	LLM response flows into subprocess, exec or eval
VGL-PI007	HIGH	Webhook payload flows directly into an AI agent
VGL-PI008	HIGH	Database content interpolated into a prompt — second-order injection
VGL-PI009	HIGH	User input written into a vector store — memory poisoning

Dockerfile Hardening (8 rules)

Rule	Severity	What it catches
VGL-DF001	HIGH	Dockerfile runs as root — no USER directive
VGL-DF002	MEDIUM	Dockerfile uses unpinned :latest base image
VGL-DF003	HIGH	Dockerfile bakes secret into ENV or ARG layer
VGL-DF004	HIGH	curl	bash or wget	sh pipe in Dockerfile RUN instruction
VGL-DF005	HIGH	TLS verification disabled in Dockerfile RUN fetch
VGL-DF006	MEDIUM	ADD used for local files — use COPY instead
VGL-DF007	HIGH	COPY . without .dockerignore — risks leaking .git, .env, credentials
VGL-DF008	MEDIUM	World-writable permissions set in Dockerfile (chmod 777)

Docker Compose (7 rules)

Rule	Severity	What it catches
VGL-D001	CRITICAL	Docker public port binding — bypasses UFW, exposes service to internet
VGL-D002	HIGH	docker-compose environment block contains hardcoded secret
VGL-D003	CRITICAL	Docker container runs in privileged mode
VGL-D004	HIGH	Docker container uses host network mode
VGL-D005	CRITICAL	Docker socket mounted into container — full container escape vector
VGL-D006	HIGH	Sensitive host path mounted into container
VGL-D007	HIGH	AWS credentials directory (~/.aws) mounted into container — exposes all profiles

Terraform (7 rules)

Rule	Severity	What it catches
VGL-TF001	CRITICAL	Terraform hardcoded secret value
VGL-TF002	HIGH	Terraform resource with public access enabled
VGL-TF003	HIGH	Terraform encryption explicitly disabled
VGL-TF004	CRITICAL	IMDSv1 enabled on EC2 instance — vulnerable to SSRF metadata theft
VGL-TF005	HIGH	Terraform S3 state backend stored without encryption
VGL-TF006	MEDIUM	Deletion protection disabled on managed resource
VGL-TF007	MEDIUM	Audit logging disabled on Terraform-managed resource

Deserialization & Path Traversal (5 rules)

Rule	Severity	What it catches
VGL-DESER001	CRITICAL	Insecure deserialization — pickle.loads / pickle.load
VGL-DESER002	HIGH	Insecure YAML deserialization — yaml.load() without SafeLoader
VGL-DESER003	HIGH	Insecure deserialization — marshal.loads with untrusted data
VGL-PATH001	HIGH	Path traversal — user input passed to file open or path join without validation
VGL-SSTI001	CRITICAL	Server-Side Template Injection — user input rendered as Jinja2 template

MCP Server Security (5 rules)

Rule	Severity	What it catches
VGL-MCP001	CRITICAL	Prompt injection embedded in MCP tool description
VGL-MCP002	HIGH	MCP tool description built from user-controlled data
VGL-MCP003	HIGH	Shell execution in an MCP tool handler without a sandbox
VGL-MCP004	HIGH	MCP server config uses an unpinned package or plaintext HTTP endpoint
VGL-MCP005	HIGH	MCP fetch tool takes an agent-controlled URL with no allowlist

Web Application Security (5 rules)

Rule	Severity	What it catches
VGL-CORS001	HIGH	CORS wildcard — allow_origins=['*']
VGL-SQL001	CRITICAL	SQL injection — query built with f-string or string concatenation
VGL-SQL002	CRITICAL	SQL injection — ORM raw query with f-string
VGL-SSL001	HIGH	SSL verification disabled
VGL-SSRF001	CRITICAL	SSRF — HTTP call with user-controlled URL

AI Agent — Excessive Agency (4 rules)

Rule	Severity	What it catches
VGL-A001	CRITICAL	LLM output piped into shell execution
VGL-A002	HIGH	Hardcoded auto-approval disables human-in-the-loop
VGL-A003	HIGH	Unbounded agent loop with no iteration limit
VGL-A004	HIGH	LLM response written to disk without validation

Authentication & Session (4 rules)

Rule	Severity	What it catches

Only the beginning is shown; read the rest in the repo

Valca

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Rystic

README from the maker

Valca

The Problem

Install

Network access

Usage

Scan a directory

JSON output (for CI / dashboards)

SARIF output (for GitHub Advanced Security)

Only report HIGH and above

Open feedback & waitlist form

Aggregate stats — rule frequency, severity mix, precision per rule

See It in Action

Rules

Secrets & Credential Exposure (14 rules)

GitHub Actions — AI Agent Surface (13 rules)

AI Agent — Prompt Injection (9 rules)

Dockerfile Hardening (8 rules)

Docker Compose (7 rules)

Terraform (7 rules)

Deserialization & Path Traversal (5 rules)

MCP Server Security (5 rules)

Web Application Security (5 rules)

AI Agent — Excessive Agency (4 rules)

Authentication & Session (4 rules)