DvalinCode MCP
Independent security checks for code from people and AI: it scans, repairs and issues a fix record that can be verified offline.
- 118 ★ on the repository
- Last commit
Extended access
Why this level
- The tool runs tests, builds and third-party scanners in your project.
- The `snyk-code` engine uploads source to Snyk, and the executor repair mode edits files.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/dvalincodeDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The tool runs tests, builds and third-party scanners in your project.
- The `snyk-code` engine uploads source to Snyk, and the executor repair mode edits files.
This is third-party code. Review the repository files before installing.
What it does
DvalinCode scans a project with built-in rules for injection, hardcoded secrets, XSS, `eval` and unsafe shell use. `npx dvalincode security scan .` works with no account, model or key, and no code leaves the machine. After a repair the tool re-scans and runs the project tests itself, reading exit codes from the processes it started. The outcome is written to a Verified Fix Record, a small JSON file checked with `dvalin verify-fix` on a machine with no network. Who wrote the repair (Claude Code, Codex, Copilot or a person) is recorded and never consulted. As an MCP server it gives the agent the `dvalin_scan`, `dvalin_verify_findings` and `dvalin_verify_fix` tools.
Who it is for. Teams where agents write code and a merge needs an independent verdict rather than the model own word.
Good fit when
- An agent closed a vulnerability and you must prove the finding is gone and no new ones appeared.
- A pull request gets a gate that fails only on new findings.
- Before a commit, only what the agent just wrote is scanned through `diff: "uncommitted"`.
- The verdict goes to a reviewer as a file they can re-check without access to your tools.
Not a fit when
- You expect a blanket claim that the code is safe: the record covers only vanished findings and passed checks.
- Source code must not go to external services and you enable `snyk-code`: it uploads code to Snyk.
- The project has no tests, build or linter: a repair with no confirming checks does not pass.
Example request
Scan the uncommitted changes, fix what you find and request an independent verification of the repair.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
Built-in rules cover a limited set of vulnerability classes, so serious checks add third-party engines: Semgrep, Snyk or CodeQL. They run only when named, `snyk-code` uploads source to Snyk, and CodeQL builds a database in minutes under a license covering open-source code and GitHub Advanced Security customers. Kotlin, C/C++ and Swift need the project build, otherwise the scan is marked partial. The VS Code extension is built but not published. A fix record confirms what was checked and does not certify the whole codebase as safe.
How to disable. Remove the server with `claude mcp remove dvalin` and the files created by `dvalin init`: `dvalin.security.json`, `.dvalin/baseline.json` and the CI workflow. Delete the pre-commit hook from `.pre-commit-config.yaml`.
FAQ
How do I install DvalinCode in Claude Code?
Run `claude mcp add dvalin -- npx -y dvalincode mcp-serve --workspace .`. For Codex, Cursor and VS Code use `npx dvalincode mcp-install codex`, `cursor` and `vscode`.
What is inside a Verified Fix Record?
The repair targets, remaining findings, what the repair introduced, the gate threshold, commands with exit codes and coverage completeness. The file is verified offline with `dvalin verify-fix fix-record.json`.
Is a key needed for the first scan?
No. `npx dvalincode security scan .` runs the built-in rules with no account, model or configuration.
Which scan engines can be added?
Semgrep, Snyk Code, Snyk OSS and CodeQL. Enable them explicitly, for example `dvalin scan . --scanners builtin,codeql`, and `dvalin scanners list` shows readiness.
What does dvalin init do?
It writes `dvalin.security.json` (fail on new findings at high or above), records current findings in `.dvalin/baseline.json` and creates a CI gate for GitHub or GitLab. Existing files are not overwritten without `--force`.
Discussion
No questions or reviews yet.
Related
MCP serversA security scanner for AI-written code: secrets, dependencies, MCP and CI, findings investigated with evidence, and fixes you approve
A skill for Claude Code and Codex that finds common vulnerabilities in AI-written code and shows a fix for each
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
Codex Security scans code, validates findings and fixes, saves evidence and exports results for review and CI workflows.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| DvalinCode (this card) | no | not required | 118 | |
| Semgrep | yes | not required | 17,471 | a rule-based static analyzer; DvalinCode runs it as one engine and issues a verifiable fix record |
| agent-security-scanner-mcp | no | not required | 123 | scans code, MCP servers and prompts with a rating; this one focuses on independent confirmation of repairs |
README in short
Dvalin sits between code generation and merge. People, agents and CI call one versioned contract for discovery, remediation and verification, and the built-in repair executor is secondary.