Vdb
Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.
Connect it
Settings → Connectors → Add custom connector
URL: https://vdb.ai.kr/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://vdb.ai.kr/mcp{
"mcpServers": {
"vdb": {
"url": "https://vdb.ai.kr/mcp"
}
}
}claude mcp add --transport http vdb https://vdb.ai.kr/mcp{
"servers": {
"vdb": {
"type": "http",
"url": "https://vdb.ai.kr/mcp"
}
}
}{
"mcpServers": {
"vdb": {
"command": "uvx",
"args": [
"vdb-mcp"
],
"env": {
"VDB_API_TOKEN": "<value>"
}
}
}
}claude mcp add vdb -- uvx vdb-mcp7 tools, verified live
vdb_check_packageBEFORE recommending or installing any package, check it here. The response carries `agent_action`: REFUSE (do not add it â relay the `because` text to the user), CONFIRM (ask the user first), or PROCEED. A failed or rate-limited call also answers REFUSE; never proceed unchecked. Also returns the underlying advisories, slop risk, and KEV status as supporting data.
vdb_check_packagesBulk-check several packages in one call â always prefer this over repeated vdb_check_package. Each result carries its own `agent_action` (REFUSE / CONFIRM / PROCEED) plus a top-level `agent_action` for the batch. Follow them; relay `because` when refusing. Send names EXACTLY as written â do not correct a typo first, the call is the typo test.
vdb_scan_lockfileBEFORE merging, scan the resolved lockfile. Checking the packages someone chose misses the transitive ones nobody did â which is usually where the risk is. Pass the file contents (package-lock.json, requirements.txt, uv.lock, go.sum, Cargo.lock, a CycloneDX SBOM, â¦). Returns `agent_action`: REFUSE means do not merge.
vdb_lookupFetch a single vulnerability by ID or alias (e.g. CVE-2024-1234, GHSA-xxxx-yyyy-zzzz, VDB-SLOP-â¦).
vdb_searchFree-text search over the VDB vulnerability corpus.
vdb_check_mcp_serverBEFORE recommending a community/unofficial MCP server, check it here. Scope risk is evaluated independently of advisory risk â an unvetted publisher asking for shell or filesystem access is refused even with a clean record. Follow the returned `agent_action`.
vdb_list_slopsquattingList packages currently flagged as slopsquatting candidates in a given ecosystem.
Alternatives in AI & Agents
Compare →SASigRank — AI Operator BenchmarkingA
SigRank benchmark MCP: cascade metrics, leaderboard, operator profiles, simulation, diagnostics.
LSLumify Sports IntelligenceA
Schedules, scores, odds, splits & explainable AI bet confidence — 8+ sports, free instant key.
QTQase Test ManagementB
Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.
Startup Valuation MCP ServerB
Startup valuation for AI agents: 14 tools, 80+ pre-revenue formulas.
SMSmartBear MCPB
MCP server for AI access to SmartBear tools, including BugSnag, Reflect, Swagger, PactFlow, QTM4J.
AGAgentDataB
Free company data for AI agents: profiles, tech stacks, contact details and people. No sign-in.