GhostFree

GhostFree runs locally from a Node.js package published to the npm registry: ghostfree version 0.2.0. It speaks MCP over stdio, so the client starts it as a program and talks to it through standard input and output. It needs Node.js; clients usually start it with npx — the usual command is npx -y ghostfree@0.2.0. It reads these environment variables: GHOSTFREE_DIR, GHOSTFREE_MIN_SEVERITY and NVD_API_KEY (secret); set them in the client's configuration for this server. Required arguments: --repo-path.

In the mcpServers JSON format that many desktop and editor MCP clients read, the entry looks like this (placeholders in angle brackets):

{
  "mcpServers": {
    "ghostfree": {
      "command": "npx",
      "args": [
        "-y",
        "ghostfree@0.2.0"
      ],
      "env": {
        "GHOSTFREE_DIR": "<value>",
        "GHOSTFREE_MIN_SEVERITY": "<value>",
        "NVD_API_KEY": "<secret>"
      }
    }
  }
}

Derived from the registry entry, not tested here. What the server does, and on what terms, is set by its publisher; check its repository or website before giving it access to your accounts or files. How to add an MCP server to an assistant · Before you connect