isMalicious threat intelligence for AI agents for VS Code
com.ismalicious/mcp-server
Indicator reputation verdicts, CVE lookups (CVSS, EPSS, KEV) and prompt-injection scans for agents
client:VS Code
transport:stdio
runtime:npm
Install isMalicious threat intelligence for AI agents in VS Code
.vscode/mcp.json
{
"inputs": [
{
"type": "promptString",
"id": "ismalicious-api-key",
"description": "ISMALICIOUS_API_KEY",
"password": true
},
{
"type": "promptString",
"id": "ismalicious-api-secret",
"description": "ISMALICIOUS_API_SECRET",
"password": true
},
{
"type": "promptString",
"id": "ismalicious-api-base",
"description": "ISMALICIOUS_API_BASE",
"password": true
},
{
"type": "promptString",
"id": "ismalicious-timeout-ms",
"description": "ISMALICIOUS_TIMEOUT_MS",
"password": true
}
],
"servers": {
"mcp-server": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@ismalicious/mcp-server"
],
"env": {
"ISMALICIOUS_API_KEY": "${input:ismalicious-api-key}",
"ISMALICIOUS_API_SECRET": "${input:ismalicious-api-secret}",
"ISMALICIOUS_API_BASE": "${input:ismalicious-api-base}",
"ISMALICIOUS_TIMEOUT_MS": "${input:ismalicious-timeout-ms}"
}
}
}
}VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs