GhostFree

What is GhostFree 🚫👻?

Every software team could use some help ridding their code base of the ghosts haunting their dependencies.

GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.

Quick Start

No installation, signup, or payment required. Add GhostFree to your MCP settings for whatever code tool you use and run /ghostfree.scan.

VS Code Copilot (Extension — easiest)

Search @mcp ghostfree in the Extensions view (Ctrl+Shift+X) and click Install. Then open the Command Palette (Ctrl+Shift+P), run MCP: List Servers, select GhostFree, choose Start Server, and confirm trust when prompted. No JSON config needed.

VS Code Copilot (Manual config)

Create or update .vscode/mcp.json in your project root:

{

"servers": { "ghostfree": { "type": "stdio", "command": "npx", "args": ["-y", "ghostfree", "--repo-path", "${workspaceFolder}"], "env": {} } } }

Claude Code

Create .mcp.json in your project root:

{

"mcpServers": { "ghostfree": { "type": "stdio", "command": "npx", "args": ["-y", "ghostfree", "--repo-path", "."] } } }

Cursor

Create .cursor/mcp.json:

{

"mcpServers": { "ghostfree": { "command": "npx", "args": ["-y", "ghostfree", "--repo-path", "."] } } }

Claude Desktop

Add to your claude_desktop_config.json (location varies by OS):

{

"mcpServers": { "ghostfree": { "command": "npx", "args": ["-y", "ghostfree", "--repo-path", "/path/to/your/repo"] } } }

How to Use

The /ghostfree.scan Prompt

The recommended way to run a scan is via the built-in prompt. In your AI client, type:

/ghostfree.scan

This drives the following flow:

1. Discover — finds all manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, etc.)
2. Threshold — asks you for a minimum severity level (CRITICAL / HIGH / MEDIUM / LOW) if not already configured
3. Scan — queries OSV.dev for CVEs across all discovered packages
4. Triage — presents numbered results, 10 at a time. You pick which ones to investigate.
5. Enrich — fetches CVSS vectors, CWE classification, and CISA KEV "actively exploited" status for your selections
6. Remediate — recommends upgrades, code changes, or risk acceptance with a reason and expiry date

Example Session

User: /ghostfree.scan

GhostFree: Discovering dependencies... Found 84 packages across 2 ecosystems (npm, PyPI).

What minimum severity should I surface? (CRITICAL / HIGH / MEDIUM / LOW)

User: HIGH

GhostFree: Scanning against OSV.dev...

[1] CVE-2021-44228 CRITICAL (10.0) — org.apache.logging.log4j:log4j-core@2.14.1 Log4Shell: Remote code execution via JNDI lookup Fix: upgrade to 2.17.1

[2] CVE-2022-25881 HIGH (7.5) — http-cache-semantics@4.1.0 ReDoS in http-cache-semantics Fix: upgrade to 4.1.1

[3] CVE-2021-28918 CRITICAL (9.8) — netmask@1.0.6 IP address parsing bypass (SSRF / allowlist bypass) Fix: upgrade to 1.1.0

Showing 1-3 of 3. Which would you like to investigate? (e.g., 1, 2, or 'all')

User: 3

GhostFree: [Calls enrich_cve CVE-2021-28918]

CVE-2021-28918 — netmask CRITICAL (9.8) CVSS: 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE: CWE-704 (Incorrect Type Conversion) CISA KEV: Not listed

What it is: netmask@1.0.6 improperly parses octal-notation IP addresses (e.g. 010.0.0.1), treating them as decimal. This enables SSRF protection bypass and IP allowlist/blocklist bypass — an attacker can craft an address that appears private but routes to a public host.

Exploit status: Not in CISA KEV. Public PoC exists (SICK-2021-011), ~280k affected projects.

Codebase exposure: netmask is not directly imported — it appears in package-lock.json as a transitive dependency of pac-resolver@3.0.0 (a transitive dev dependency). No direct require('netmask') or IP parsing logic found. Reachability is very low.

Recommendation: Upgrade — low effort, patch version (1.0.6 → 1.1.0), no API changes. netmask is a transitive dependency; use npm audit fix or add a package.json overrides entry to force netmask@1.1.0.

→ Reply with a number to investigate another CVE, 'back' to return to the list, 'fix' to apply the recommended fix, 'accept' to record an accepted risk, or 'done' to wrap up.

Example: Accepting a Known Risk

User: Accept CVE-2022-25881 — it's only in our CI test pipeline, not reachable in production. Expiry end of year.

GhostFree: [Calls accept_risk CVE-2022-25881]

Accepted risk recorded: • CVE-2022-25881 — http-cache-semantics (HIGH, CVSS 7.5) Reason: Only used in CI test pipeline, not reachable in production Expires: 2026-12-31 ID: 550e8400-e29b-41d4-a716-446655440000

This acceptance is saved to .ghostfree/accepted.yml. Commit this file to share the decision with your team. The CVE will be suppressed on future scans until expiry.

User: List all accepted risks

GhostFree: [Calls list_accepted_risks]

Accepted Risks (1)

CVE-2022-25881 — ✅ expires in 272 days (2026-12-31) | Severity at acceptance: HIGH (7.5) ID: 550e8400-e29b-41d4-a716-446655440000 Reason: Only used in CI test pipeline, not reachable in production Accepted: 2026-04-03T10:00:00.000Z

Example: Enriching a Specific CVE

User: Tell me everything about CVE-2021-44228

GhostFree: [Calls enrich_cve CVE-2021-44228]

Enrichment: CVE-2021-44228

NVD

CVSS Score: 10.0 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: CWE-917 (Improper Neutralization of Special Elements in an Expression Language Statement)

References: • https://nvd.nist.gov/vuln/detail/CVE-2021-44228 • https://logging.apache.org/log4j/2.x/security.html

CISA KEV

⚠️ CONFIRMED actively exploited in the wild (added to KEV: 2021-12-10)

Tools Reference

All read-only tools are safe to auto-approve in your MCP client. Write tools (accept_risk, remove_accepted_risk) will prompt for confirmation.

check_cves Inputs

accept_risk Inputs

Configuration

Create .ghostfree/config.yml in your repo root to set a persistent severity threshold that's shared with your team via source control:

min_severity: HIGH

This takes priority over the environment variable. If neither is set, GhostFree will prompt you to choose at scan time.

Environment Variables

VS Code extension users: create a .env file in your workspace root — the extension reads it automatically and forwards the values to the server. For all other setups (manual MCP JSON config): add these to the "env" block in your client's config file (.vscode/mcp.json, .mcp.json, .cursor/mcp.json, claude_desktop_config.json, etc.), or export them as system environment variables.

Accepted Risk Management

When you accept a risk, GhostFree writes it to .ghostfree/accepted.yml in your repo root. Commit this file to share accepted decisions with your team.

accepted_risks:

• id: 550e8400-e29b-41d4-a716-446655440000 cve_id: CVE-2022-25881 reason: Only used in CI test pipeline, not reachable in production expires_on: "2027-01-01" accepted_at: "2026-04-02T10:00:00.000Z" severity_at_acceptance: HIGH cvss_score_at_acceptance: 7.5

Rules:

• expires_on is required — no open-ended acceptances
• Expiry within 1 year: accepted immediately
• Expiry beyond 1 year: requires confirm_extended_expiry=true
• Expired acceptances are never silently dropped — they resurface as warnings on every scan

Supported Ecosystems & Manifests

Version range handling

When a manifest specifies a version range rather than an exact version, GhostFree extracts a single version to query vulnerability databases. We use two taxonomies to keep the reasoning clear: VRC (what a specifier *means*) and VRHP (what we *do* about it).

Version Range Concepts (VRC)

A VRC is an ecosystem-agnostic label for what a version specifier expresses. Multiple VRCs can apply to the same entry (e.g. a caret range *with* a prerelease tag is vrc-caret + vrc-prerelease).

| vrc-exclusive-range | Bracket interval with exclusive lower | NuGet `(4.1.3,