Integrations

MCP

vscan mcp starts a local stdio MCP server for coding agents.

vscan mcp

Run the installer to configure a supported host:

vscan mcp init

The installer supports Claude, Codex, and Cursor. It asks which package manager to use and which host to configure.

The MCP server is intended for incremental file scans while an agent is writing code. Use the CLI for full project scans:

vscan ./repo

MCP is best for tight edit-review loops: an agent changes a file, scans that file, then decides whether a suggested solution belongs in the patch.

JSONL

Use JSONL when another tool needs to read scan output:

vscan ./repo --format jsonl > report.jsonl

Each finding is emitted as one JSON object:

{
	"file": "src/db.py",
	"vulnerabilities": ["CWE-89"],
	"vulnerability_name": "SQL Injection",
	"solution": "..."
}

solution is omitted when no resolution is available.

JSONL is useful for CI logs, saved reports, and agent summaries because each finding can be handled independently.

JSONL With Solution

vscan ./repo --format jsonl --yes > report.jsonl

This streams findings and auto-applies suggested solutions. It is useful for automation that should produce both a report and a set of code changes.

Prompting Agents

Use short, explicit prompts that tell the agent when to scan and what scope to use.

Scan every new file after writing it:

After you create a new source file, run vscan against that file before moving on.
Apply suggested solution when they are safe, and summarize any finding you leave
unaddressed.

Scan changed files before ending the turn:

Before you finish your turn, run vscan against every file you changed in this
turn. Report each finding by file, CWE, and vulnerability name. Apply safe solutions
or explain why a finding was left unchanged.

Scan after installing libraries:

If you install or update a library, run vscan against the files that import or
configure that library before finishing. Summarize any findings and any solutions
you applied.

For broader checks, ask the agent to use the CLI:

Run vscan . --format jsonl at the end of the task and summarize the findings.

Good prompts tell the agent what to scan, whether it may apply solutions, and how to report anything it leaves unchanged.