README.md

Introduction

This folder contains the source code for running VDB as a Model Context Protocol (MCP) server. Below you can find the configuration for running the VDB MCP server with Claude Desktop. Please feel free to share the configuration for other clients via pull requests.

Pre-requisites

• Python >= 3.10 installed
• docker or Rancher Desktop (or)
• uv installed

docker-based execution (Recommended)

Use our container image ghcr.io/appthreat/mcp-server-vdb:master.

Claude Desktop configuration

Edit the file using VS code or any editor of your choice. ~/Library/Application Support/Claude/claude_desktop_config.json. On Windows, the config file is $env:AppData\Claude\claude_desktop_config.json. Use the below configuration:

{
  "mcpServers": {
    "vdb": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "VDB_HOME=/db",
        "-v",
        "$HOME/vdb:/db:rw",
        "ghcr.io/appthreat/mcp-server-vdb:master"
      ]
    }
  }
}

nerdctl example.

{
  "mcpServers": {
    "vdb": {
      "command": "nerdctl",
      "args": [
        "run", "-i", "--rm", "-e", "VDB_HOME=/db", "-v", "$HOME/vdb:/db:rw", "ghcr.io/appthreat/mcp-server-vdb:master"
      ]
    }
  }
}

Restart the Claude Desktop application.

If you get ENOENT error, specify the full path to docker. On a mac, /Applications/Docker.app/Contents/Resources/bin/docker.

Local uv-based execution (Developers only)

git clone https://github.com/AppThreat/vulnerability-db.git
cd vulnerability-db
python -m pip install .

export VDB_HOME=$HOME/vdb
mkdir -p $VDB_HOME
vdb --download-image
uv --directory contrib/mcp-server-vdb run mcp-server-vdb

Claude Desktop configuration

Edit the file using VS code or any editor of your choice. ~/Library/Application Support/Claude/claude_desktop_config.json. On Windows, the config file is $env:AppData\Claude\claude_desktop_config.json.

Use the below configuration and adjust the following paths:

• absolute path to the mcp-server-vdb inside the contrib directory.
• VDB_HOME - Full path to the directory containing the vulnerability database. Must have run vdb --download-image

{
  "mcpServers": {
    "vdb": {
      "command": "uv",
      "args": [
        "--directory",
        "/Volumes/Work/AppThreat/vulnerability-db/contrib/mcp-server-vdb",
        "run",
        "mcp-server-vdb"
      ],
      "env": {
        "VDB_HOME": "/Users/guest/vdb"
      }
    }
  }
}

Restart the Claude Desktop application.

Screenshots

Claude context screen

Claude permissions on first run

Claude results

Latest malware

Configuration for MCP Inspector

• Transport Type: STDIO
• Command: python
• Arguments: vdb/server.py

Click "Connect"

Testing

1. Click "List Tools". Must see a list of tools such as search_by_purl_like, search_by_any, and so on.
2. Select search_by_purl_like and enter a purl string such as pkg:swift/vapor/vapor@4.89.0.