Feature · MCP server

Ask your AI assistant whether your projects are exposed.

LibWatch exposes an MCP server: Claude, Cursor, VS Code or Codex can query the vulnerabilities, dependencies and SBOMs of your projects, and can start an analysis if you allow it.

Create an MCP token
Read with an AI .md version
Claude Code 
$ claude mcp add --transport http libwatch \
    https://app.libwatch.com/mcp \
    --header "Authorization: Bearer YOUR_TOKEN"

> Are my PHP projects affected
  by PHP2Shell?

What the assistant can do

Ten tools, read-only by default

Read

Projects and summaries

list_projects, get_project_security_summary, get_analysis_status.

Read

Vulnerabilities and alerts

list_vulnerabilities, list_alerts.

Read

Dependencies and SBOM

list_dependencies, get_sbom_summary.

Read

Licenses

list_license_findings: the dependencies that break your license policy.

Write, if allowed

Read & write token

Start an analysis

prepare_scan then confirm_scan: two steps, to avoid starting one by mistake.

Compatible

Your assistants

Claude Code, Claude Desktop, Cursor, VS Code (Copilot) and Codex: configuration ready to paste.

Connect

Two minutes, one token

The token only sees the projects you have access to, in the first organization you are a member of.

Create an MCP token

Account › Settings › MCP tokens: name, expiration (30 days, 90 days, 1 year or never) and permissions. It is shown only once.

Paste your assistant's configuration

The page shows the ready-made command or file for each assistant.

Ask your question

“Which critical vulnerabilities hit my projects this week?”

Frequently asked questions

About the MCP server

Does my code go through the assistant?
No. The MCP server returns security data: projects, versions, vulnerabilities. Never your code.
Can I limit a token to read-only?
Yes, it's the default setting. To start an analysis, you need a read & write token, and a team administrator must have granted you that permission.
Is there a limit on calls?
Yes: 120 requests per minute per token. Reads use nothing; each analysis started counts toward your plan's analysis quota.

Your assistant already knows your code. Give it your vulnerabilities.

Start your trial