Best for
- AI coding agents (like Claude, Cursor) that require typed security scan results.
- Development environments that need to reduce token consumption and improve output reliability.
P
Pare Security
Community
Structured security scanning (Trivy) as typed JSON.
- Category
- Dev Tools #408 of 438
- Stars
- ★ 139 Popular
- Transport
- stdio (local process)
- Runtime
- Node.js >=20
- Credentials
- No credential needed
- License
- MIT
- Last commit
31FMRS · D
This server is part of the Pare project, focusing on security scanning consistency. It provides structured output to improve efficiency and reliability for AI agents. Due to lack of specific tool list and client support info, users should refer to official docs for detailed configuration.
Strongest · Setup experience 9/20 Weakest · Reliability 4/20
Why each score
- Reliability 4/20
- Only the manifest was supplied: it declares npm package @paretools/security, stdio transport, and version 0.22.0. The README describes the monorepo and claims structuredContent/outputSchema support, but no source code, tests, CI workflows, tool schemas, or package README for the security server were provided. Without verifiable execution evidence, the happy path cannot be confirmed, and whether the declared package actually exposes matching tools is unproven. Scored conservatively below the 10-point anchor due to missing tests and implementation detail.
- Security and permissions 6/20
- No red-line issues are evident: there is no credential theft, covert exfiltration, destructive-by-default commands, or real secrets in examples. The README table indicates the server wraps Trivy scanning, which is largely read-only. However, since the server source is not in evidence, command construction, least-privilege boundaries, network behavior, and confirmation flows cannot be verified. Deducted for lack of source-level security review.
- Maintenance 8/20
- Evidence is limited: the manifest shows version 0.22.0, the README declares an MIT license, and the repository is not archived. This suggests versioning and licensing exist, but there is no verifiable commit history, release cadence, issue-response record, or security-response channel. CI/coverage badges in the README are monorepo-level and cannot be statically validated. A mid-to-high score is appropriate but not higher.
- Documentation 4/20
- The README provides general monorepo information, token-efficiency claims, quickstart steps, and troubleshooting, but nothing specific to server-security: no tool list, parameters, output schemas, limits, cost, or Trivy configuration examples. The generic JSON client example uses pare-git rather than this server. Server-specific documentation is effectively absent, so this dimension is scored low.
- Setup experience 9/20
- The manifest gives a concrete npm package identifier (@paretools/security) and stdio transport; the README states Node.js >= 20 and provides npx-based setup, presets, multi-client configuration guides, and a troubleshooting table. The install path is plausible. However, there is no server-specific configuration example and no CI/test execution evidence verifying that path; Windows/npx issues are handled only generically. This prevents a higher score.
Static review · not runListed 2026-08-07
Read the FMRS scoring method →Fit and risk
What it can accessReads local filesRuns commands or codeUses the network
Not for
- Users who do not need security scanning or prefer raw CLI output.
- Non-Node.js environments or Node.js versions older than 20.
Required permissions
- Requires permission to execute Trivy commands (the server does not run scans itself; it relies on system Trivy or configuration).
- Requires file system access to read scan targets (e.g., project directories, images).
Risks and side effects
- Dependency on Trivy and Node.js environment stability; misconfiguration can lead to scan failures or incomplete output.
- Structured output may omit some of Trivy's advanced features or custom options, leading to incomplete information.
Setup
Before you start
Runtime：Node.js >=20
Other optional settings (1)
PARE_TOOLS
Universal tool filter across all Pare servers, formatted as comma-separated server:tool pairs (e.g. git:status); nothing to obtain externally.
- Add the following server configuration to your MCP client:
{
"mcpServers": {
"pare-security": {
"command": "npx",
"args": ["-y", "@paretools/security"]
}
}
}- Ensure Node.js 20 or later is installed.
- Restart your MCP client session.
Check that it works
Confirm the Pare Security server (@paretools/security, v0.22.0) appears in your client's tool list, or run npx @paretools/init doctor, then ask the agent to scan the project for vulnerabilities and check that structured JSON results come back.
Troubleshooting
- Verify that Trivy is installed and accessible in PATH.
- Check Node.js version is >=20.
- Inspect MCP client logs to confirm server startup.
- Try running `npx -y @paretools/security` directly in the terminal to verify installation.
Things to try
Once connected, you can ask your AI assistant things like:
- Scan this project's dependencies for vulnerabilities and list them by severity
- Run a Trivy scan on this repository and return all CVEs as JSON
- Check whether any npm dependencies in this project have high-severity vulnerabilities
- Do a security scan of the repo and summarize the most urgent fixes
Use cases
When an AI agent needs to perform security scans and directly process structured results, such as in CI/CD pipelines or as part of development workflows.
When integrating Trivy scan results with other automation or analysis systems.
Overview
Pare Security is an MCP server from the Pare project that wraps Trivy security scanning and returns structured, schema-validated JSON instead of raw terminal text. It provides typed data that AI agents can act on directly, avoiding brittle string parsing. The server uses stdio transport and is distributed via the npm package @paretools/security.
Similar servers
Context7
80 · B
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
NPM Sentinel MCP Server
79 · B
AI-powered NPM package analysis MCP server
MartinLoop MCP Server
79 · B
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub MCP Server
76 · B
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
More servers from this repository
Source revision f76328c1c7c7 Data synced 2026-10-19 Read the FMRS scoring method