Back to Browse

Dvalincode MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.

About

Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.

Security Report

4.2
Use Caution4.2High Risk

Dvalin is a security scanner whose visible code spawns external CLIs without a shell, keeps configuration and environment handling explicit, and requires no API key for its built-in scan. The main concern is that the VS Code extension reads the dvalin.command setting, which a workspace can set, and runs it automatically on activation and save, so opening an untrusted repository can execute an arbitrary command. The provided source is truncated, so the review covers only part of the codebase. Supply chain analysis found 6 known vulnerabilities in dependencies (0 critical, 4 high severity). Package verification found 1 issue.

11 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-arthurpanhku-dvalincode": {
      "args": [
        "-y",
        "dvalincode"
      ],
      "command": "npx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!