AI导哈

npm漏洞扫描工具

PatchPilot是一款集成到AI编程工具中的npm包安全扫描服务，通过OSV API检测已知漏洞并提供修复建议。

  • by ProduktEntdecker
  • JavaScript
  • 本地部署
  • 更新于
在 GitHub 查看 ProduktEntdecker/patchpilot-mcp

使用说明

PatchPilot MCP

Security scanner for vibe coders. Checks npm packages for known vulnerabilities before you install them.

What it does

PatchPilot is an MCP server that integrates with Claude Code, Cursor, and other AI coding tools. When you're about to install a package, you can ask Claude to check if it's safe first.

Example:

You: "Check if lodash@4.17.0 is safe to use"
Claude: 🚨 lodash@4.17.0 has 4 known vulnerabilities!
        ...
        💡 Recommendation: Update to lodash@4.17.21 or later

Installation

Prerequisites

  • Node.js 18+
  • Claude Code or another MCP-compatible client

Setup

  1. Clone this repository:
git clone https://github.com/YOUR_USERNAME/patchpilot-mcp.git
cd patchpilot-mcp
  1. Install dependencies:
npm install
  1. Build:
npm run build

Add to Claude Code

Add to your Claude Code config (~/.claude/settings.json):

{
  "mcpServers": {
    "patchpilot": {
      "command": "node",
      "args": ["/path/to/patchpilot-mcp/dist/index.js"]
    }
  }
}

Or for development (without building):

{
  "mcpServers": {
    "patchpilot": {
      "command": "npx",
      "args": ["tsx", "/path/to/patchpilot-mcp/src/index.ts"]
    }
  }
}

Restart Claude Code after adding the config.

Usage

Once installed, ask Claude to check packages:

  • "Check if express@4.17.0 is safe"
  • "Is next@14.1.0 secure?"
  • "Check lodash 4.17.0 for vulnerabilities"

How it works

PatchPilot uses the OSV API (Google's Open Source Vulnerabilities database) to check packages. The API is:

  • Free (no API key needed)
  • Fast
  • Comprehensive (aggregates data from npm, GitHub, NVD, and more)

Available Tools

check_package

Check a single npm package for known vulnerabilities.

Input:

  • name: Package name (e.g., "lodash")
  • version: Package version (e.g., "4.17.0")

Output:

  • Vulnerability count and severity breakdown
  • Details of each vulnerability
  • Recommended fix version

License

MIT

相关 MCP