Free checks for what your AI pulls in.
Twelve free, keyless commands that vet what an AI assistant wants to add to your project: packages that do not exist or are malicious, MCP servers, tools, skills, memory files and editor extensions. Nothing leaves your machine.
$ curl -fsSL https://dist.vulkro.com/install-live.sh | bash one binary, no account, no key
Twelve checks, one binary.
Everything an assistant can pull into a project, checked before it lands.
verify
Is this package real, and is it safe? Catches invented names, typosquats, known-malicious releases and known vulnerabilities before anything is installed.
foresee
The names an assistant is likely to invent for your stack, so they can be blocked before they are ever suggested.
warden
Checks a third-party MCP server's tool descriptions, or a returned tool result, for prompt injection, tool poisoning, hidden characters and exfiltration.
inspect
Is this MCP server safe to add? Resolves the server, checks the package behind it, and answers green, review or avoid.
audit
Your whole agent surface at once: every configured MCP server, plus the rules, skills, instruction files and network-reaching hooks.
skillscan
Reads what your skills, slash commands and subagents actually run, not just their prose, and flags stealer behaviour.
memcheck
Checks an agent's memory files for planted instructions and credentials that should never have been written down.
trustdb
Clear a package or server once and every Labs tool trusts that version until it changes, recorded in a file you can commit.
lock and drift
Lock takes a fingerprint of an MCP server's tools; drift reports what changed field by field, so a quiet rug pull is loud.
cardcheck
Checks an agent card for the permissions and endpoints it claims, against what it can actually reach.
mcp
Runs the free checks as an MCP server, so your assistant can vet its own package suggestions and tool manifests in the loop.
Every check, as SARIF
Each check can write SARIF, so the results land in the same place your other security tools report to.
Keyless, and it never leaves your machine.
Keyless
No account, no key, no sign-in. Download it and run it.
On your machine
Nothing about your project is uploaded. The checks that need public package data read it and nothing else.
Free, and separate
The free tools vet what enters your project. Vulkro, the licensed scanner, analyses the code you write. Two tools, one download location.