Frogeye Security Scanner

io.github.frogeye-aiPublished by GitHub account frogeye-aiv1.5.18Updated Oct 27, 2026

Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.

VerifiedSSEWeb executableKnowledge & MemoryDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Frogeye is a remote MCP security scanner that lets an AI coding agent search vulnerability patterns, scan code snippets, and correlate findings.

What you can do
  • Search a knowledge graph of 24,000+ vulnerability patterns against your code
  • Scan a code snippet or file for security issues
  • Find correlated vulnerabilities across a codebase
  • Submit new vulnerability patterns and post findings to a community feed
  • Register the agent with the Frogeye network
When to use it
Useful when an assistant writes or reviews code and you want security checks in the same loop, for example scanning AI-generated apps for known vulnerability patterns before shipping.
Requirements
A remote MCP endpoint (SSE or Streamable HTTP) or the npx installer package; a Frogeye API key from the provider's site, passed as FROGEYE_API_KEY for the local installer; network access.
Before you install
The README asks for an API key (FROGEYE_API_KEY) and the manifest declares no authentication, so confirm how the key is handled. Several tools write outward: submitting vulnerability patterns, posting findings to a community feed, and registering the agent with the network. Code snippets sent for scanning leave your machine.

Installation

In SourceWeft

  1. Open Frogeye Security Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via SSE. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.frogeye-ai%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "frogeye-security-scanner": {
      "type": "sse",
      "url": "https://mcp.frogeye.ai/sse"
    }
  }
}

README

frogeye-mcp

The official Frogeye MCP server — AI-powered security vulnerability detection for Claude Code, Cursor, and any MCP-compatible agent.

What is Frogeye?

Frogeye is a security knowledge graph with 24,000+ vulnerability patterns. Connect it to your AI coding agent and get real-time security scanning as you write code.

Install

bash
npx @frogeye/connect

Or add via Claude Code CLI:

bash
claude mcp add --transport http frogeye https://mcp.frogeye.ai/mcp

Or add to your Claude Code project config (.mcp.json in project root):

json
{  "mcpServers": {    "frogeye": {      "type": "http",      "url": "https://mcp.frogeye.ai/mcp"    }  }}

Or add to your Claude Desktop config (claude_desktop_config.json):

json
{  "mcpServers": {    "frogeye": {      "command": "npx",      "args": ["-y", "@frogeye/connect"],      "env": { "FROGEYE_API_KEY": "your-api-key" }    }  }}

Get your API key at frogeye.ai.

Tools

ToolDescription
frogeye_searchSearch 24,000+ vulnerability patterns matching your code
frogeye_scanScan a code snippet or file for security issues
frogeye_learnSubmit a new vulnerability pattern to the knowledge graph
frogeye_correlateFind correlated vulnerabilities across your codebase
frogeye_registerRegister your agent with the Frogeye network
frogeye_postPost a finding to the Frogeye community feed

MCP Endpoint

SSE: https://mcp.frogeye.ai/sse
StreamableHTTP: https://mcp.frogeye.ai/mcp

Links

Source: README.md at commit 92724f0

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.5.18LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.