debsecan-mcp

What it is and what it does

debsecan-mcp is a Model Context Protocol server that integrates vulnerability scanning into AI assistants and development tools. It discovers installed packages on a Debian system, fetches vulnerability data from the Debian Security Tracker, and enriches the results with EPSS (Exploit Prediction Scoring System) scores from CISA to help prioritize which vulnerabilities pose the greatest risk. The package runs as an MCP server over stdio, SSE, or HTTP transports, making it usable with Claude Desktop, VSCode, or other MCP-compatible clients.

The package also includes a standalone CLI tool called debvulns for command-line vulnerability scanning without running the server. It caches downloaded vulnerability and EPSS data locally (with automatic refresh after 24 hours) and supports filtering by severity, custom output formats (JSON or CSV), and sorting options. However, this package has been renamed to debvulns as of version 0.1.5, which is the final release under the debsecan-mcp name.

Use it for:

• Integrate vulnerability scanning into Claude Desktop or VSCode to get real-time security alerts for installed packages
• Run debvulns CLI to generate a CSV report of high-severity vulnerabilities on a Debian system for compliance auditing
• Query specific CVEs via the research_cves tool to get EPSS scores and exploitability details before patching decisions
• Set up an HTTP-based MCP server to expose Debian security scanning to remote AI assistants in containerized environments

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

An MCP server that scans Debian systems for known security vulnerabilities in installed packages and provides CVE details with EPSS exploit prediction scores.

Yes, if you run Debian and want to integrate vulnerability scanning into an AI assistant or CLI workflow. The package is actively maintained, has low install friction, and no known vulnerabilities. However, note that this is the final release under the debsecan-mcp name—migrate to the renamed debvulns package for future updates.

Install

debsecan-mcp on PyPI

pip install debsecan-mcp

uv add debsecan-mcp

poetry add debsecan-mcp

Installing debsecan-mcp

Before you install

Low friction install with six runtime dependencies. Active maintenance as of 33 days ago. Note: this package has been renamed to debvulns; version 0.1.5 is the final release under the debsecan-mcp name.

Quickstart

# Install
pip install debsecan-mcp

# Run MCP server (default stdio mode)
debsecan-mcp

# Or use the CLI tool
debvulns --severity high --format json

Requires Python 3.11+, a Debian-based distribution, and network access to download vulnerability data from Debian Security Tracker and CISA.

Verify before relying

• Whether the package works on non-Debian systems or only Debian-based distributions
• Performance characteristics when scanning systems with large numbers of installed packages
• Whether cached vulnerability data persists across system reboots or requires re-download

Package facts

Evidence: debsecan_mcp-0.1.5-py3-none-any.whl

Tags

More Security packages

Further reading