Best for
- AI coding agents (like Claude, Cursor) that require typed security scan results.
- Development environments that need to reduce token consumption and improve output reliability.
P
Pare Security
Community
Structured security scanning (Trivy) as typed JSON.
GitHub source repository ↗
31FMRS · D
This server is part of the Pare project, focusing on security scanning consistency. It provides structured output to improve efficiency and reliability for AI agents. Due to lack of specific tool list and client support info, users should refer to official docs for detailed configuration.
Pare Security is an MCP server from the Pare project that wraps Trivy security scanning and returns structured, schema-validated JSON instead of raw terminal text. It provides typed data that AI agents can act on directly, avoiding brittle string parsing. The server uses stdio transport and is distributed via the npm package @paretools/security.
Tools
The tool list has not been reviewed yet.
Setup
- Add the following server configuration to your MCP client:
{
"mcpServers": {
"pare-security": {
"command": "npx",
"args": ["-y", "@paretools/security"]
}
}
}- Ensure Node.js 20 or later is installed.
- Restart your MCP client session.
Fit and risk
Not for
- Users who do not need security scanning or prefer raw CLI output.
- Non-Node.js environments or Node.js versions older than 20.
Required permissions
- Requires permission to execute Trivy commands (the server does not run scans itself; it relies on system Trivy or configuration).
- Requires file system access to read scan targets (e.g., project directories, images).
Risks and side effects
- Dependency on Trivy and Node.js environment stability; misconfiguration can lead to scan failures or incomplete output.
- Structured output may omit some of Trivy's advanced features or custom options, leading to incomplete information.
Troubleshooting
- Verify that Trivy is installed and accessible in PATH.
- Check Node.js version is >=20.
- Inspect MCP client logs to confirm server startup.
- Try running `npx -y @paretools/security` directly in the terminal to verify installation.
Use cases
When an AI agent needs to perform security scans and directly process structured results, such as in CI/CD pipelines or as part of development workflows.
When integrating Trivy scan results with other automation or analysis systems.
Supported clients
Supported clients have not been confirmed yet.