# io.github.DownAtTheBottomOfTheMoleHole/megalinter (npm · @downatthebottomofthemolehole/megalinter-mcp-server)

MCP server for running Ox Security MegaLinter via mega-linter-runner

- Trust score: 77/100 (medium)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@downatthebottomofthemolehole/megalinter-mcp-server`: 77/100 (this document), [markdown](https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server.md), [page](https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@downatthebottomofthemolehole/megalinter-mcp-server`
- Version: `3.0.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to DownAtTheBottomOfTheMoleHole/megalinter-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 148 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 807 tokens (~89/item across 9 items; 9 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add downatthebottomofthemolehole-megalinter -- npx -y @downatthebottomofthemolehole/megalinter-mcp-server
```

### Codex

```bash
codex mcp add downatthebottomofthemolehole-megalinter -- npx -y @downatthebottomofthemolehole/megalinter-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "downatthebottomofthemolehole-megalinter": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@downatthebottomofthemolehole/megalinter-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add downatthebottomofthemolehole-megalinter --command npx --arg -y --arg @downatthebottomofthemolehole/megalinter-mcp-server
```

### Hermes

```yaml
mcp_servers:
  downatthebottomofthemolehole-megalinter:
    command: "npx"
    args: ["-y", "@downatthebottomofthemolehole/megalinter-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "downatthebottomofthemolehole-megalinter": {
      "command": "npx",
      "args": [
        "-y",
        "@downatthebottomofthemolehole/megalinter-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 73, +53)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: DownAtTheBottomOfTheMoleHole/megalinter-mcp
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 20, +14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 6, −40)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (9)

### `megalinter_run` (~317 tokens)

Run Ox Security MegaLinter using mega-linter-runner. Works locally or in any CI/CD environment.

Input parameters:

- `configFile` (string): Path to .mega-linter.yml file.
- `containerName` (string): Optional Docker container name.
- `disableLinters` (string): Comma-separated list of linters to disable.
- `env` (string): Environment variable string passed to --env (for example: DISABLE_LINTERS=SPELL_CSPELL,MARKDOWN_MARKDOWNLINT).
- `extraArgs` (array): Additional CLI arguments to append.
- `fix` (boolean): Apply auto-fixes.
- `flavor` (string): MegaLinter flavor.
- `help` (boolean): Show mega-linter-runner help.
- `image` (string): Optional full Docker image override.
- `install` (boolean): Generate MegaLinter starter config files.
- `lintChangedFilesOnly` (boolean): If true, sets VALIDATE_ALL_CODEBASE=false to lint only changed files.
- `path` (string): Directory path to lint.
- `release` (string): MegaLinter Docker image tag.
- `removeContainer` (boolean): Remove container after completion.
- `reportsPath` (string): Directory where reports are written.
- `runnerVersion` (string): mega-linter-runner npm version. Use 'latest' or a specific version.
- `timeoutSeconds` (number): Command timeout in seconds.
- `workingDirectory` (string): Directory where the command is executed. Defaults to current process directory.

### `megalinter_write_config` (~117 tokens)

Generate a minimal .mega-linter.yml configuration file.

Input parameters:

- `applyFixes` (string): Value for APPLY_FIXES (none, all, or linter list).
- `disableLinters` (array): Optional list for DISABLE_LINTERS.
- `flavorSuggestions` (boolean): Set FLAVOR_SUGGESTIONS.
- `showElapsedTime` (boolean): Set SHOW_ELAPSED_TIME.
- `targetPath` (string): Output path for the MegaLinter config file. Defaults to .mega-linter.yml

### `megalinter_list_flavors` (~20 tokens)

List commonly used MegaLinter flavors.

### `megalinter_get_linters` (~79 tokens)

Discover available linters by language, security category, or auto-fix capability.

Input parameters:

- `autoFixOnly` (boolean): Return only linters that support automatic fixes.
- `language` (string): Filter by programming language (e.g., python, javascript, terraform).
- `securityOnly` (boolean): Return only security-focused linters.

### `megalinter_get_security_info` (~36 tokens)

Get comprehensive information about security-focused linters organized by category (SAST, secrets, supply-chain, container, infrastructure).

### `megalinter_get_reporters` (~24 tokens)

List all available MegaLinter reporters and their configuration options.

### `megalinter_parse_reports` (~70 tokens)

Parse MegaLinter JSON or SARIF reports from the reports directory. Returns structured report data for analysis.

Input parameters:

- `reportType` (string): Type of report to parse. Defaults to json.
- `reportsPath` (string): Path to the reports directory. Defaults to megalinter-reports.

### `megalinter_get_issue_summary` (~86 tokens)

Analyze and summarize issues from MegaLinter reports by severity, linter, and category. Enables filtering and targeted remediation.

Input parameters:

- `linterFilter` (string): Filter issues by specific linter name.
- `reportsPath` (string): Path to the reports directory. Defaults to megalinter-reports.
- `severityFilter` (string): Filter issues by severity level.

### `megalinter_get_security_recommendations` (~58 tokens)

Generate security-focused recommendations based on active linters and common threat categories (SAST, secrets, container, infrastructure).

Input parameters:

- `reportsPath` (string): Path to the reports directory. Defaults to megalinter-reports.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 73
- 2026-08-01: 20
- 2026-07-31: 6
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server
- Socket report: https://socket.dev/npm/package/@downatthebottomofthemolehole/megalinter-mcp-server
- Repository: https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-mcp
- Changelog RSS feed: https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/downatthebottomofthemolehole-megalinter/downatthebottomofthemolehole-megalinter-mcp-server