Mantivor CLI

Scan the MCP servers in your Mantivor organisation from a terminal or a CI pipeline, and fail the build when a scan finds something.

Mantivor is a hosted security scanner for Model Context Protocol servers. This package is its command-line client: it talks to the hosted API over HTTPS and does nothing else, which is why it installs in about 2.7 MB from two direct dependencies (httpx and typer-slim). The scanning happens on our side, not on your runner.

You need a Mantivor organisation to use this. Sign up free at mantivor.io — the free tier covers one server.

uv tool install mantivor     # or: pipx install mantivor
mantivor login
mantivor scan --hosted <server-id>

Commands

mantivor --help lists every flag.

CI

Set VORLOX_API_KEY instead of running mantivor login — a pipeline has no terminal to prompt at, and a key passed as a command-line flag lands in the build log. The variable takes precedence over a stored credential, so a job is never affected by whoever last logged in on the runner.

export VORLOX_API_KEY=vlx_live_...
mantivor scan --hosted <server-id> --fail-on high

--fail-on takes info, low, medium, high or critical, and is unset by default.

Exit codes: 0 scan completed and the gate passed, 1 scan completed and a finding met or exceeded --fail-on, 2 the scan could not run at all (no credential, refused, unreachable). 1 and 2 are kept distinct so a pipeline can tell "we found something" from "we never looked".

The environment variables are spelled VORLOX_* — VORLOX_API_KEY and VORLOX_API_URL. That is not a typo and not stale documentation: Vorlox was this product's former name, and the variables keep the old spelling so existing pipelines do not break. They are the correct, current names.

Before the CLI can scan a server

A person must add the server in the Mantivor dashboard and confirm they are authorised to scan it. An API key cannot do this for itself — a pipeline must not be able to manufacture the authorisation for the target it then scans. The server's page shows its ID once it is confirmed.

Your key needs the scans:write scope to scan, and findings:read to read findings. Scopes are fixed when a key is created; to change them, mint a new key. Create keys at Settings → API keys in the dashboard.

Scope of this package

Hosted commands only. Scanning a local MCP server from your own machine (--name / --endpoint / --transport) is not part of this package — the detectors are not shipped here. Passing those flags prints an explanation rather than an unknown-option error.

Licence

Proprietary. Installing and running it against your own Mantivor organisation is permitted; redistribution and modification are not. The full terms ship in the package as LICENSE.

Support: mantivor.io/support · Questions about the licence: contact@mantivor.io