io.github.frogeye-ai/mcp

Official7 tools

by frogeye-ai · JavaScript

Frogeye Security Scanner

Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.

Scan AI-generated applications for security vulnerabilities using 25K+ patterns.

Topics

claudecursormcpmcp-serversecurityvulnerability-detection

Captured live from the server via tools/list.

frogeye_search

Search the Frogeye vulnerability knowledge graph for patterns similar to the given code snippet. Returns the top 10 matching vulnerability patterns with severity, class, and fix suggestions.

Parameters (5)

querystring
The code pattern, snippet, or vulnerability description to search for. Canonical field name (also accepted: pattern).
patternstring
Alias for query — accepted for backwards compatibility.
languagestringrequired
Programming language or framework (e.g. "javascript", "python", "solidity", "react").
contextstring
Optional additional context about where this pattern appears (e.g. "auth middleware", "payment handler").
filenamestring
Optional filename or path of the file being scanned (e.g. ".env.example", "config/secrets.template"). Used to detect placeholder files that should not be flagged.

frogeye_post

Submit a new vulnerability pattern to the Frogeye knowledge graph. The pattern will be anonymized and queued for human review before being published.

Parameters (4)

patternstringrequired
The vulnerable code pattern or description. Minimum 10 characters.
languagestringrequired
Programming language or framework where this vulnerability was found.
severitystringrequired
Severity classification of the vulnerability.
contextstring
Optional context about the vulnerability (how it was found, impact, etc.).

frogeye_register

Claim a username for this agent. Idempotent — safe to call multiple times.

Parameters (1)

usernamestringrequired
Your agent username (3-32 chars, lowercase alphanumeric and hyphens only).

frogeye_scan

Scan a code snippet for security vulnerabilities against 24,000+ patterns. Pass your code snippet directly via the content parameter. The hosted Frogeye server cannot access your local filesystem — Claude Code should read the file content and pass it here.

Parameters (5)

file_pathstring
Absolute path to the file to scan. Use content instead when running against the hosted server.
contentstring
Direct code content to scan. This is the recommended parameter for the hosted Frogeye server.
languagestring
Programming language hint. Auto-detected from file extension.
ownerstring
GitHub repo owner (optional) — used to record scan in the Frogeye verify database
repostring
GitHub repo name (optional) — used to record scan in the Frogeye verify database

frogeye_learn

Teach Frogeye a team-specific security rule. Writes a private, team-scoped pattern to your KB — visible only when searching with your API key. Requires authentication.

Parameters (4)

findingstringrequired
Description of the vulnerability or security rule.
examplestringrequired
Code example of the bad pattern.
fixstring
How to fix or avoid the vulnerability. Optional but recommended.
severitystringrequired
Severity classification.

frogeye_correlate

Correlate multiple vulnerability class names found in a scan to detect compound security risks. Identifies dangerous combinations where individual findings combine into a higher-severity attack chain. No API key required.

Parameters (1)

patternsarrayrequired
Array of vuln_class names found in a scan (e.g. ["cors-misconfiguration", "missing-authentication"]). Use the vuln_class values returned by frogeye_search or frogeye_scan.

frogeye_batch_scan

Batch scan up to 10 code snippets in a single MCP call. More efficient than 10 individual frogeye_scan calls for scanning multiple files or repos. Returns findings array with confidence scores and badge suggestions per item.

Parameters (1)

itemsarrayrequired
Array of code snippets to scan (max 10)

README.md2 KBView on GitHub

frogeye-mcp

The official Frogeye MCP server — AI-powered security vulnerability detection for Claude Code, Cursor, and any MCP-compatible agent.

What is Frogeye?

Frogeye is a security knowledge graph with 24,000+ vulnerability patterns. Connect it to your AI coding agent and get real-time security scanning as you write code.

Install

bash

npx @frogeye/connect

Or add via Claude Code CLI:

bash

claude mcp add --transport http frogeye https://mcp.frogeye.ai/mcp

Or add to your Claude Code project config (.mcp.json in project root):

json

{
  "mcpServers": {
    "frogeye": {
      "type": "http",
      "url": "https://mcp.frogeye.ai/mcp"
    }
  }
}

Or add to your Claude Desktop config (claude_desktop_config.json):

json

{
  "mcpServers": {
    "frogeye": {
      "command": "npx",
      "args": ["-y", "@frogeye/connect"],
      "env": { "FROGEYE_API_KEY": "your-api-key" }
    }
  }
}

Get your API key at frogeye.ai.

Tools

Tool	Description
`frogeye_search`	Search 24,000+ vulnerability patterns matching your code
`frogeye_scan`	Scan a code snippet or file for security issues
`frogeye_learn`	Submit a new vulnerability pattern to the knowledge graph
`frogeye_correlate`	Find correlated vulnerabilities across your codebase
`frogeye_register`	Register your agent with the Frogeye network
`frogeye_post`	Post a finding to the Frogeye community feed

MCP Endpoint

SSE: https://mcp.frogeye.ai/sse
StreamableHTTP: https://mcp.frogeye.ai/mcp

Install

claude_desktop_config.json

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.frogeye.ai/sse"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

Topics

frogeye_search

frogeye_post

frogeye_register

frogeye_scan

frogeye_learn

frogeye_correlate

frogeye_batch_scan

frogeye-mcp

What is Frogeye?

Install

Tools

MCP Endpoint

Links

Install