vorlox 0.1.1

Vorlox — MCP security scanning for your hosted organisation

Vorlox CLI

Scan the MCP servers in your hosted Vorlox organisation from a terminal or a CI pipeline.

uv tool install vorlox     # or: pipx install vorlox
vorlox login
vorlox scan --hosted <server-id>

Commands

Command	What it does
vorlox login	Store an API key (prompted, never echoed, never an argv flag)
vorlox logout	Remove the stored key
vorlox auth status	Show which credential is active, without printing it
vorlox scan --hosted <id>	Scan a server in your organisation
vorlox findings	List findings, newest first

CI

Set VORLOX_API_KEY instead of running vorlox login. It takes precedence over a stored credential, so a pipeline is never affected by whoever last logged in on the runner.

export VORLOX_API_KEY=vlx_live_...
vorlox scan --hosted <server-id> --fail-on high

Exit codes: 0 passed, 1 a finding met or exceeded --fail-on, 2 the scan could not run.

Before the CLI can scan a server

A person must add the server in the Vorlox dashboard and confirm they are authorised to scan it. An API key cannot do this for itself — a pipeline must not be able to manufacture the authorisation for the target it then scans. The server's page shows its ID once it is confirmed.

Your key needs the scans:write scope to scan, and findings:read to read findings. Create keys in Settings → API keys.

Scope

This package talks to the hosted Vorlox API over HTTPS. Scanning a local MCP server from your own machine is not part of it.