Free, keyless, and it stays on your machine
.
Twelve free, keyless commands that vet what an AI assistant wants to add to your project: packages that do not exist or are malicious, MCP servers, tools, skills, memory files and editor extensions. Nothing leaves your machine.
$ curl -fsSL https://dist.vulkro.com/install-live.sh | bash- No account
- No key
- Nothing leaves the machine
How it works_
$ curl -fsSL https://dist.vulkro.com/install-live.sh | bash
# no account
# no key
# nothing leaves the machineKeyless
No account, no key, no sign-in. Download it and run it.
On your machine
Nothing about your project is uploaded. The checks that need public package data read it and nothing else.
Free, and separate
The free tools vet what enters your project. Vulkro, the licensed scanner, analyses the code you write. Two tools, one download location.
What it checks_
Everything an assistant can pull into a project, checked before it lands.
verify
Is this package real, and is it safe? Catches invented names, typosquats, known-malicious releases and known vulnerabilities before anything is installed.
foresee
The names an assistant is likely to invent for your stack, so they can be blocked before they are ever suggested.
warden
Checks a third-party MCP server's tool descriptions, or a returned tool result, for prompt injection, tool poisoning, hidden characters and exfiltration.
inspect
Is this MCP server safe to add? Resolves the server, checks the package behind it, and answers green, review or avoid.
audit
Your whole agent surface at once: every configured MCP server, plus the rules, skills, instruction files and network-reaching hooks.
skillscan
Reads what your skills, slash commands and subagents actually run, not just their prose, and flags stealer behaviour.
memcheck
Checks an agent's memory files for planted instructions and credentials that should never have been written down.
trustdb
Clear a package or server once and every Labs tool trusts that version until it changes, recorded in a file you can commit.
lock and drift
Lock takes a fingerprint of an MCP server's tools; drift reports what changed field by field, so a quiet rug pull is loud.
cardcheck
Checks an agent card for the permissions and endpoints it claims, against what it can actually reach.
mcp
Runs the free checks as an MCP server, so your assistant can vet its own package suggestions and tool manifests in the loop.
Every check, as SARIF
Each check can write SARIF, so the results land in the same place your other security tools report to.
The free tools vet what enters. Vulkro checks what you write.
Vulkro finds real vulnerabilities in your own code and shows the attack path behind each one, on your machine. Your first sign-in starts a 14-day trial of the full product, no card.
The free tools vet what enters your project. Vulkro, the licensed scanner, analyses the code you write. Two tools, one download location.