MCP Server

Expose scan_package to AI coding agents

primer mcp starts a Model Context Protocol server over stdio. Any MCP-capable agent — Claude Code, Cursor, Cline — can call scan_package before deciding to install a package, making vulnerability checking part of its reasoning rather than a post-hoc interception.

Setup

Add primer to your project's .mcp.json:

{
  "mcpServers": {
    "primer": {
      "command": "primer",
      "args": ["mcp"]
    }
  }
}

Or add to ~/.claude/mcp.json for global availability across all projects.

The `scan_package` tool

Parameters

Parameter	Type	Required	Description
`name`	string	yes	Package name
`ecosystem`	string	yes	`PyPI`, `npm`, `Go`, or `crates.io`
`version`	string	no	Specific version to check. Omit to check the latest.

Response

{
  "vulnerabilities": [
    {
      "id": "GHSA-56pw-mpj4-fxjw",
      "severity": "CRITICAL",
      "summary": "Heap buffer overflow in TIFF image parser",
      "fixed_version": "9.0.1"
    }
  ],
  "summary": {
    "blocking": true,
    "count": 1
  }
}

summary.blocking is true when any finding meets or exceeds the active prompt-threshold. Agents should read this field to decide whether to proceed — do not inspect the vulnerabilities array directly. An empty array with blocking: false means safe to install.

How it works

JSON-RPC 2.0 over stdio — no daemon, no port binding, no new dependencies.
Uses primer's OSV scan engine with the same 24 h local cache — repeated agent queries for the same package return instantly.
The allow-list (.primer-ignore) is not consulted — MCP is query-only, not an intercept gate.
Graceful shutdown on stdin EOF.

Claude Code example

Once configured, Claude Code will call scan_package automatically when deciding whether to install a package:

> Install pillow for image processing

[calling scan_package("pillow", "PyPI", "9.0.0")]

scan_package result: CRITICAL — GHSA-56pw-mpj4-fxjw
  Heap buffer overflow in TIFF image parser
  Fixed in: 9.0.1

I found a critical vulnerability in pillow 9.0.0. I recommend installing
the fixed version instead:

pip install "pillow>=9.0.1"

Supported MCP methods

Method	Description
`initialize`	MCP handshake with server capabilities
`initialized`	Notification (no response required)
`tools/list`	Returns `scan_package` with its JSON Schema
`tools/call`	Dispatches `scan_package` to the OSV engine