What is GhostFree 🚫👻?

Every software team could use some help ridding their code base of the ghosts haunting their dependencies.

GhostFree is a local MCP server that scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.

Quick Start

No installation, signup, or payment required. Add GhostFree to your MCP settings for whatever code tool you use and run /ghostfree.scan.

VS Code Copilot (Extension — easiest)

Search @mcp ghostfree in the Extensions view (Ctrl+Shift+X) and click Install. Then open the Command Palette (Ctrl+Shift+P), run MCP: List Servers, select GhostFree, choose Start Server, and confirm trust when prompted. No JSON config needed.

VS Code Copilot (Manual config)

Create or update .vscode/mcp.json in your project root:

{
  "servers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "${workspaceFolder}"],
      "env": {}
    }
  }
}

Claude Code

Create .mcp.json in your project root:

{
  "mcpServers": {
    "ghostfree": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Cursor

Create .cursor/mcp.json:

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "."]
    }
  }
}

Claude Desktop

Add to your claude_desktop_config.json (location varies by OS):

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": ["-y", "ghostfree", "--repo-path", "/path/to/your/repo"]
    }
  }
}

How to Use

The /ghostfree.scan Prompt

The recommended way to run a scan is via the built-in prompt. In your AI client, type:

/ghostfree.scan

This drives the following flow:

1. Discover — finds all manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, etc.)
2. Threshold — asks you for a minimum severity level (CRITICAL / HIGH / MEDIUM / LOW) if not already configured
3. Scan — queries OSV.dev for CVEs across all discovered packages
4. Triage — presents numbered results, 10 at a time. You pick which ones to investigate.
5. Enrich — fetches CVSS vectors, CWE classification, and CISA KEV "actively exploited" status for your selections
6. Remediate — recommends upgrades, code changes, or risk acceptance with a reason and expiry date

Example Session

User: /ghostfree.scan

GhostFree: Discovering dependencies...
Found 84 packages across 2 ecosystems (npm, PyPI).

What minimum severity should I surface? (CRITICAL / HIGH / MEDIUM / LOW)

User: HIGH

GhostFree: Scanning against OSV.dev...

[1] CVE-2021-44228 CRITICAL (10.0) — org.apache.logging.log4j:log4j-core@2.14.1
    Log4Shell: Remote code execution via JNDI lookup
    Fix: upgrade to 2.17.1

[2] CVE-2022-25881 HIGH (7.5) — http-cache-semantics@4.1.0
    ReDoS in http-cache-semantics
    Fix: upgrade to 4.1.1

[3] CVE-2021-28918 CRITICAL (9.8) — netmask@1.0.6
    IP address parsing bypass (SSRF / allowlist bypass)
    Fix: upgrade to 1.1.0

Showing 1-3 of 3. Which would you like to investigate? (e.g., 1, 2, or 'all')

User: 3

GhostFree: [Calls enrich_cve CVE-2021-28918]

CVE-2021-28918 — netmask CRITICAL (9.8)
CVSS: 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-704 (Incorrect Type Conversion)
CISA KEV: Not listed

What it is: netmask@1.0.6 improperly parses octal-notation IP addresses (e.g. 010.0.0.1),
treating them as decimal. This enables SSRF protection bypass and IP allowlist/blocklist
bypass — an attacker can craft an address that appears private but routes to a public host.

Exploit status: Not in CISA KEV. Public PoC exists (SICK-2021-011), ~280k affected projects.

Codebase exposure: netmask is not directly imported — it appears in package-lock.json as a
transitive dependency of pac-resolver@3.0.0 (a transitive dev dependency). No direct
require('netmask') or IP parsing logic found. Reachability is very low.

Recommendation: Upgrade — low effort, patch version (1.0.6 → 1.1.0), no API changes.
netmask is a transitive dependency; use npm audit fix or add a package.json overrides entry
to force netmask@1.1.0.

→ Reply with a number to investigate another CVE, 'back' to return to the list,
  'fix' to apply the recommended fix, 'accept' to record an accepted risk, or 'done' to wrap up.

Example: Accepting a Known Risk

User: Accept CVE-2022-25881 — it's only in our CI test pipeline, not reachable in production. Expiry end of year.

GhostFree: [Calls accept_risk CVE-2022-25881]

Accepted risk recorded:
• CVE-2022-25881 — http-cache-semantics (HIGH, CVSS 7.5)
  Reason: Only used in CI test pipeline, not reachable in production
  Expires: 2026-12-31
  ID: 550e8400-e29b-41d4-a716-446655440000

This acceptance is saved to .ghostfree/accepted.yml. Commit this file to share the
decision with your team. The CVE will be suppressed on future scans until expiry.

User: List all accepted risks

GhostFree: [Calls list_accepted_risks]

## Accepted Risks (1)

**CVE-2022-25881** — ✅ expires in 272 days (2026-12-31) | Severity at acceptance: HIGH (7.5)
  ID: 550e8400-e29b-41d4-a716-446655440000
  Reason: Only used in CI test pipeline, not reachable in production
  Accepted: 2026-04-03T10:00:00.000Z

Example: Enriching a Specific CVE

User: Tell me everything about CVE-2021-44228

GhostFree: [Calls enrich_cve CVE-2021-44228]

## Enrichment: CVE-2021-44228

### NVD
CVSS Score: 10.0 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-917 (Improper Neutralization of Special Elements in an Expression Language Statement)

References:
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://logging.apache.org/log4j/2.x/security.html

### CISA KEV
⚠️ CONFIRMED actively exploited in the wild (added to KEV: 2021-12-10)

Tools Reference

All read-only tools are safe to auto-approve in your MCP client. Write tools (accept_risk, remove_accepted_risk) will prompt for confirmation.

check_cves Inputs

accept_risk Inputs

Configuration

Create .ghostfree/config.yml in your repo root to set a persistent severity threshold that's shared with your team via source control:

min_severity: HIGH

This takes priority over the environment variable. If neither is set, GhostFree will prompt you to choose at scan time.

Environment Variables

VS Code extension users: create a .env file in your workspace root — the extension reads it automatically and forwards the values to the server. For all other setups (manual MCP JSON config): add these to the "env" block in your client's config file (.vscode/mcp.json, .mcp.json, .cursor/mcp.json, claude_desktop_config.json, etc.), or export them as system environment variables.

Accepted Risk Management

When you accept a risk, GhostFree writes it to .ghostfree/accepted.yml in your repo root. Commit this file to share accepted decisions with your team.

accepted_risks:
  - id: 550e8400-e29b-41d4-a716-446655440000
    cve_id: CVE-2022-25881
    reason: Only used in CI test pipeline, not reachable in production
    expires_on: "2027-01-01"
    accepted_at: "2026-04-02T10:00:00.000Z"
    severity_at_acceptance: HIGH
    cvss_score_at_acceptance: 7.5

Rules:

• expires_on is required — no open-ended acceptances
• Expiry within 1 year: accepted immediately
• Expiry beyond 1 year: requires confirm_extended_expiry=true
• Expired acceptances are never silently dropped — they resurface as warnings on every scan

Supported Ecosystems & Manifests

Version range handling

When a manifest specifies a version range rather than an exact version, GhostFree extracts a single version to query vulnerability databases. We use two taxonomies to keep the reasoning clear: VRC (what a specifier means) and VRHP (what we do about it).

Version Range Concepts (VRC)

A VRC is an ecosystem-agnostic label for what a version specifier expresses. Multiple VRCs can apply to the same entry (e.g. a caret range with a prerelease tag is vrc-caret + vrc-prerelease).

Version Range Handling Principles (VRHP)

A VRHP is the action GhostFree takes once a VRC is identified. String-keyed so ordering never matters.

Ecosystem examples

FAQ

Q: Why would I need something more than my current AI coding agent(s)?
Your AI agent's knowledge of vulnerabilities is frozen at its training cutoff. New CVEs are disclosed daily — example: Log4Shell, for example, was disclosed in December 2021 and would be invisible to any model trained before that.

GhostFree queries live authoritative vulnerability reporting organizations for up to date information, so every scan reflects the current threat landscape regardless of when your model was trained. This extra context is also critical in increasing the accuracy or whatever suggestions or recommendations your agent can provide.

It also tracks your accepted risks with reasons and expiry dates, building an auditable record that lives in your repo.

It aims to do all of this with as much determinism as can be introduced while still at its coring being run by your chosen agent that interacts with GhostFree. While running it with the best model you can afford is our recommendation, this determinism strategy helps cheaper/weaker models be decently effective vulnerability remediationa assistants when aided with GhostFree from our testing.

Q: Does GhostFree upload my code anywhere?
No. Only package names and versions are sent to OSV.dev. No source code leaves your machine.

Q: Do I need an API key?
No. OSV.dev requires no auth. NVD enrichment works without a key (rate-limited to 5 req/30s) which you are unlikely to hit in typical human use of this tool (you would start to see if running in some autonomous agent setup though). Set env variable NVD_API_KEY for higher limits (see nist.gov website for more details).

Q: What if I'm offline?
The scan requires OSV.dev access. NVD and KEV enrichment will gracefully degrade with a warning if unreachable.

Q: Does it scan transitive dependencies?
Partially. When a lock file is present, GhostFree scans the full resolved dependency graph (direct + transitive): package-lock.json for Node.js, Cargo.lock for Rust, go.sum for Go, and Pipfile.lock for Python. For ecosystems without lock file support (Java, .NET), only directly declared dependencies are scanned.

Q: The scan found a CVE I've already fixed. What do I do?
Update the package version in your manifest. On the next scan it will no longer appear.

Support

For bugs and feature requests, open an issue on GitHub.

Privacy Policy

GhostFree processes your repository's dependency manifests locally on your machine. Here is exactly what data leaves your machine and where it goes:

No source code, file contents, repository names, user identifiers, or telemetry data of any kind are ever coded to be sent anywhere by us. As when interacting with any AI assisted tools, your underlying environment, AI model, agent, IDE, etc. are beyond our control in how it chooses to interact with our code and your code. Anyone making use of this tool should familiarize themselves with the information in our included LICENSE.txt (MIT).

GhostFree does not collect, store, or share any data. All processing happens locally. The accepted risks file (.ghostfree/accepted.yml) stays in your repository under your control.

For questions, open an issue on GitHub.

Acknowledgements

GhostFree is built entirely on the shoulders of three organizations that have made their vulnerability intelligence freely available to the world and all the vulnerability researchers around the world that report CVEs. Without them, this tool would not exist.

Google Open Source Security Team — Open Source Vulnerabilities (OSV)
OSV.dev is the backbone of every GhostFree scan. It provides a free, open API for querying known vulnerabilities across all major package ecosystems by package name and version, and includes severity scores and fix version data in a single response. Its generous rate limits and zero-auth design make it ideal for a tool that runs locally on every developer's machine.

U.S. National Institute of Standards and Technology — National Vulnerability Database (NVD)
The National Vulnerability Database, maintained by NIST within the U.S. Department of Commerce, is the authoritative source for standardised CVSS severity vectors and CWE classification for every published CVE. GhostFree calls the NVD API 2.0 during per-CVE triage to surface the full technical detail a developer needs to make an informed remediation decision.

U.S. Cybersecurity and Infrastructure Security Agency — Known Exploited Vulnerabilities (KEV)
CISA, part of the U.S. Department of Homeland Security, publishes and maintains the Known Exploited Vulnerabilities catalog — a curated list of CVEs confirmed to be actively exploited in the wild. GhostFree downloads and uses this catalog to answer the one question that most changes how urgently a team should act: Is this being exploited right now?

Our goal is to make the security intelligence these organizations produce — gathered at significant public expense and shared freely in the interest of a safer internet — as accessible as possible to every developer, wherever they work. The bad actors chasing these vulnerabilities don't sleep. Neither does the data.