# Ask your AI assistant whether your projects are exposed.

Source: https://libwatch.com/en/features/mcp-server

Feature · MCP server

LibWatch exposes an MCP server: Claude, Cursor, VS Code or Codex can query the vulnerabilities, dependencies and SBOMs of your projects, and can start an analysis if you allow it.

[Create an MCP token](https://app.libwatch.com/users/sign_up)

Claude Code

```
$ claude mcp add --transport http libwatch \
    https://app.libwatch.com/mcp \
    --header "Authorization: Bearer YOUR_TOKEN"

> Are my PHP projects affected
  by PHP2Shell?
```

What the assistant can do

## Ten tools, read-only by default

Read

### Projects and summaries

list\_projects, get\_project\_security\_summary, get\_analysis\_status.

Read

### Vulnerabilities and alerts

list\_vulnerabilities, list\_alerts.

Read

### Dependencies and SBOM

list\_dependencies, get\_sbom\_summary.

Read

### Licenses

list\_license\_findings: the dependencies that break your license policy.

Write, if allowed

Read & write token
### Start an analysis

prepare\_scan then confirm\_scan: two steps, to avoid starting one by mistake.

Compatible

### Your assistants

Claude Code, Claude Desktop, Cursor, VS Code (Copilot) and Codex: configuration ready to paste.

Connect

## Two minutes, one token

The token only sees the projects you have access to, in the first organization you are a member of.

### Create an MCP token

Account › Settings › MCP tokens: name, expiration (30 days, 90 days, 1 year or never) and permissions. It is shown only once.

### Paste your assistant's configuration

The page shows the ready-made command or file for each assistant.

### Ask your question

“Which critical vulnerabilities hit my projects this week?”

Frequently asked questions

## About the MCP server

### Does my code go through the assistant?

 No. The MCP server returns security data: projects, versions, vulnerabilities. Never your code.

### Can I limit a token to read-only?

 Yes, it's the default setting. To start an analysis, you need a read & write token, and a team administrator must have granted you that permission.

### Is there a limit on calls?

 Yes: 120 requests per minute per token. Reads use nothing; each analysis started counts toward your plan's analysis quota.

## Your assistant already knows your code. Give it your vulnerabilities.

[Start your trial](https://app.libwatch.com/users/sign_up)