English Français العربية

VulX Watch

Official registry Developer tools

Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.

Source code Website Documentation

What can you do with VulX Watch?

  • Patch your app or open a merge-ready PR
  • Log in to your running site or database
  • Give a 0–100 score or a “safe to ship”
  • Treat a quiet week as an all-clear

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http vulx-watch 'https://mcp.vulx.ai/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "vulx-watch": {
            "type": "http",
            "url": "https://mcp.vulx.ai/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. VulX Watch for Cursor
  2. What you get
  3. Install
  4. What it will not do
  5. License

VulX Watch for Cursor

Adds the VulX Watch connector to Cursor: independent security review for AI-built apps. The agent can watch a GitHub repo and ask what the last reading found.

VulX does not write a patch or open a PR.

What you get

  • MCP server at https://mcp.vulx.ai/mcp
  • A skill so the agent knows when to call Watch
  • Commands: watch-repo, security-status

You still need a VulX account. Sign-in happens when Cursor talks to the connector. Free while we build it.

Install

  1. Install VulX Watch from the Cursor Marketplace, or clone this repo into ~/.cursor/plugins/local and restart Cursor.
  2. Complete the VulX sign-in prompt.
  3. Ask: Watch my repo owner/name with VulX. Then: What did VulX find?

If OAuth does not finish inside Cursor, add the same URL as a custom connector: https://mcp.vulx.ai/mcp. Human page: https://vulx.ai/connect

What it will not do

  • Patch your app or open a merge-ready PR
  • Log in to your running site or database
  • Give a 0–100 score or a “safe to ship”
  • Treat a quiet week as an all-clear

It reads committed source. It writes only its own brief (AGENTS.md and CLAUDE.md) when brief delivery is on.

License

MIT

Frequently asked questions

What is VulX Watch?

Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.

How do I install VulX Watch?

It runs as a remote server. In Claude Code: claude mcp add --transport http vulx-watch 'https://mcp.vulx.ai/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does VulX Watch need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is VulX Watch open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains VulX Watch?

It is published by NgoTomek. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.