GhostFree — Dependency Vulnerability Scanner

Every software team could use some help ridding their codebase of the ghosts haunting their dependencies.

This extension registers GhostFree as an MCP server in VS Code, making it available to GitHub Copilot and other AI assistants automatically — no manual JSON configuration required.

GhostFree scans your repository's dependencies for known vulnerabilities based on issued CVEs using OSV.dev, helps you triage and fix findings with NVD and CISA KEV enrichment, and lets you manage accepted risks — all directly from your AI coding assistant.

For the full documentation, including CLI usage, architecture details, and contributing guidelines, see the main repository README.

Quick Start

Install this extension
Open the Command Palette (Ctrl+Shift+P) and run MCP: List Servers
Select GhostFree from the list, then choose Start Server and confirm trust when prompted
Open a workspace with dependencies
In Copilot Chat, type /ghostfree.scan

No signup, no API key, no configuration needed.

How It Works

Type /ghostfree.scan in GitHub Copilot Chat to kick off the full workflow:

Discover — finds all manifest files (requirements.txt, package.json, go.mod, Cargo.toml, pom.xml, *.csproj, etc.)
Threshold — determines minimum severity level from GHOSTFREE_MIN_SEVERITY env var, .ghostfree/config.yml, or by prompting you (CRITICAL / HIGH / MEDIUM / LOW)
Scan — queries OSV.dev for CVEs across all discovered packages
Triage — presents numbered results, 10 at a time
Enrich — fetches CVSS vectors, CWE classification, and CISA KEV "actively exploited" status
Remediate — recommends upgrades, code changes, or risk acceptance

Example Session

User: /ghostfree.scan

GhostFree: Discovering dependencies...
Found 84 packages across 2 ecosystems (npm, PyPI).
Severity threshold: HIGH (source: environment variable (GHOSTFREE_MIN_SEVERITY))

User: HIGH

GhostFree: Scanning against OSV.dev...

[1] CVE-2021-44228 CRITICAL (10.0) — org.apache.logging.log4j:log4j-core@2.14.1
    Log4Shell: Remote code execution via JNDI lookup
    Fix: upgrade to 2.17.1

[2] CVE-2022-25881 HIGH (7.5) — http-cache-semantics@4.1.0
    ReDoS in http-cache-semantics
    Fix: upgrade to 4.1.1

Showing 1-2 of 2. Which would you like to investigate? (e.g., 1, 2, or 'all')

Tools Reference

Tool	Read-only	Description
`discover_dependencies`	✅	Scan repo manifests, return all pinned packages by ecosystem
`check_cves`	✅	Query OSV.dev for CVEs, filter by severity, apply accepted risks
`enrich_cve`	✅	Fetch CVSS, CWE, references from NVD + KEV exploitation status
`list_accepted_risks`	✅	List all accepted risks with expiry status and severity snapshot
`accept_risk`	❌	Record an accepted risk with reason, expiry date, and severity snapshot
`remove_accepted_risk`	❌	Remove an accepted risk by UUID

All read-only tools are safe to auto-approve. Write tools (accept_risk, remove_accepted_risk) will prompt for confirmation.

Accepted Risk Management

When you accept a risk, GhostFree writes it to .ghostfree/accepted.yml in your repo. Commit this file to share accepted decisions with your team.

expires_on is required — no open-ended acceptances
Expiry beyond 1 year requires confirm_extended_expiry=true
Expired acceptances resurface as warnings on every scan — never silently dropped

Supported Ecosystems

Ecosystem	Manifest Files
Python	`requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `setup.cfg`
Node.js	`package.json`, `package-lock.json`
Go	`go.mod`, `go.sum`
Rust	`Cargo.toml`, `Cargo.lock`
Java	`pom.xml`, `build.gradle`, `build.gradle.kts`
.NET	`*.csproj`, `packages.config`

Lock files (package-lock.json, Cargo.lock, go.sum, Pipfile.lock) are used when present, giving full transitive dependency coverage.

Environment Variables & Configuration

For VS Code: Create a .env file in your workspace root. The GhostFree server reads it automatically at startup. As always .env to your .gitignore to keep API keys local.

# .env (workspace-local, not committed)
NVD_API_KEY=your-key-here
GHOSTFREE_MIN_SEVERITY=HIGH

For all MCP clients: If you can't use .env (e.g., using manual mcp.json or claude_desktop_config.json), set these as standard environment variables or in your client's "env" config block:

Variable	Description
`NVD_API_KEY`	Optional — raises NVD rate limit from 5 to 50 req/30s
`GHOSTFREE_MIN_SEVERITY`	Optional — override severity threshold. Resolution order: tool argument → env var → config file → prompt user
`GHOSTFREE_DIR`	Optional — use a custom directory instead of `.ghostfree/` (applies to both `accepted.yml` and `config.yml`)

Team defaults: For a repo-scoped setting that you can commit and share, create .ghostfree/config.yml:

min_severity: HIGH

This is only used if no explicit tool argument or env var is provided — env vars take precedence.

Privacy

Only package names and versions are sent to OSV.dev. CVE IDs are sent to NVD and CISA KEV for enrichment. No source code, file contents, or user identifiers ever leave your machine.

FAQ

Q: Does GhostFree upload my code? No. Only package names, versions, and CVE IDs are sent to external APIs.

Q: Do I need an API key? No. Everything works without keys. An NVD_API_KEY is optional for higher rate limits.

Q: Does it scan transitive dependencies? Yes, when a lock file is present. Without a lock file, only directly declared dependencies are scanned.

Q: Why not just use my AI's built-in knowledge? Your AI's vulnerability knowledge is frozen at its training cutoff. GhostFree queries live databases on every scan, so it reflects the current threat landscape regardless of model age.

GhostFree - Dependency Vulnerability Scanner

shane-js