Draugr MCP server

Draugr

Security scanning for CI from one file, with every finding ranked by exposure, criticality, exploitability and reachability.

Describe your app. Draugr figures out the rest.

Every application carries problems nobody put there on purpose: a library that turned out to have a hole in it, a password committed by accident, a server setting that leaves a door open. Draugr finds them, works out which ones actually matter for *your* app, and answers the question you are really asking before a release. is this safe to ship?

It runs the established open-source scanners for you, Trivy, Semgrep, Gitleaks and others, so there is nothing to choose between, wire up, or read five of. You describe what you built, once, in one file: where the repositories are, what images it builds, what it exposes, what infrastructure it runs on. Draugr picks the checks that apply, runs the right tool for each, and produces evidence you can hand to somebody else. Bring the scanners you already pay for, or use the open-source defaults.

Findings are ranked, not listed. A scanner's "critical" describes a flaw in the abstract. How bad it could be at its worst, anywhere. The same flaw is act-now in the service strangers can reach and backlog in the internal tool three people use, and no scanner can tell those apart because the difference is in the file you wrote, not in the code. And `draugr diff` gates a pull request on new findings only, so inheriting two hundred existing ones does not block every change.

[Quickstart](#quickstart) · See it in action · What it checks · In your pipeline · Documentation · What Draugr doesn't promise · Security

See it in action

Priority (P1–P4) is not severity. Severity says how bad a flaw is at its worst, anywhere. Priority weighs that against how exposed and how important the part of your app it sits in is, which no scanner can work out, because it is not in the code.

[draugr-dev/draugr-demo](https://github.com/draugr-dev/draugr-demo) is a deliberately vulnerable app wired to Draugr: every control lights up, findings land in the repo's Security → Code scanning tab, and its example pull requests show the new-vs-fixed diff.

Quickstart

curl -fsSL https://draugr.dev/install.sh | sh

Installs to ~/.local/bin, no sudo. It verifies before it installs and says which checks ran, the archive's SHA-256 against the release checksums.txt, plus the cosign signature on that file when cosign is on your PATH, and installs nothing if a check fails. The script is readable in the repo; other routes, including Homebrew and go install, are in the install guide.

draugr init            # describe this project in a draugr.saga.yaml
draugr tools install   # fetch the scanners it needs, pinned and verified
draugr scan            # scan what the descriptor describes