vetkit

dev.vetkitPublished by vetkit.devv0.1.0Updated Nov 1, 2026

Audit repos for security, code quality and AI code risks; read findings and open fix PRs.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: dev.vetkit/mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Nov 1, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to vetkit.dev. It runs from a package rather than a hosted endpoint, so there is no endpoint to match against that domain.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/dev.vetkit%2Fmcp.svg)](https://sourceweft.com/mcp/dev.vetkit%2Fmcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

vetkit audits repositories for security, code quality and AI code risks, letting an assistant read findings and open fix pull requests.

What you can do: Run repository audits covering security, code quality and AI-generated code risks
Read audit findings and results for a repository
Open pull requests that fix the issues found
Work across organizations when the API key grants access to more than one
When to use it: Useful when you want an assistant to check a codebase for security and quality problems and then act on the results, such as drafting fix pull requests, without leaving the chat.
Requirements: Runs locally as an npm package over stdio, so Node.js is needed. Requires a vetkit API key supplied in the VETKIT_API_KEY environment variable; VETKIT_ORG_ID is needed only when the key can access several organizations. Desktop client only.

Before you install

The API key is a secret that grants access to your vetkit account and repositories. The server can open pull requests, which changes repository state, so review proposed fixes before merging. Findings and repository data are sent to the vetkit service.

Installation

In SourceWeft

Open vetkit in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Tools

SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

v0.1.0LatestNov 1, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
License10 pts
Declare a license in the repository or the registry entry.