Skip to content

Configure the k9 MCP Server

The k9 MCP server brings Reachable Risk to your AI coding agent. It scores your CVE and dependency backlog by what is actually reachable in your code and actively exploited in the wild (KEV + EPSS), and returns a Fix Today / Schedule / Defer verdict with the evidence behind each call. Your agent supplies the reachability read; k9 supplies KEV + EPSS and the verdict.

It runs as a remote MCP server. Your agent connects over HTTP and you sign in with your k9 account on first connect. There is no API key or token to copy.

Before you start

  • A k9 account. Sign up at https://www.k9security.io/lp/reachable-risk/ (7-day free trial, no card). The trial clock starts on your first scored finding.
  • Endpoint: https://mcp.k9security.io/mcp (Streamable HTTP).
  • Authentication: OAuth. On first connect your agent opens a browser to sign into your k9 account. No API key.
  • Tools: lookup_kev, lookup_epss, score_risk.
  • Prompts: risk_scoring_rubric, plus the Reachable Risk workflow: fetch_dependency_alerts, score_dependency_alerts, fix_dependency_alerts. Agents that surface MCP prompts expose these as slash commands; others can read the matching k9://workflow/… resource.

Many agents accept the generic mcpServers config-block form:

{
  "mcpServers": {
    "k9": {
      "type": "http",
      "url": "https://mcp.k9security.io/mcp"
    }
  }
}

Claude (claude.ai and Claude Desktop)

  1. Open Settings → Connectors → Add custom connector.
  2. Paste the k9 MCP server URL and click Add: https://mcp.k9security.io/mcp

Claude opens a browser to sign into your k9 account on first connect.

Claude Code

There are several ways to register an MCP server with Claude Code. The simplest:

claude mcp add --transport http k9 https://mcp.k9security.io/

Claude Code opens the browser sign-in on first use. Config-file equivalent: add the generic mcpServers block above to ~/.claude.json.

Opencode

  1. Add k9 to opencode.json (project root, or global ~/.config/opencode/opencode.json). Opencode uses its own mcp key with type: remote (not the mcpServers form):

    json { "$schema": "https://opencode.ai/config.json", "mcp": { "k9": { "type": "remote", "url": "https://mcp.k9security.io/mcp", "enabled": true } } }

  2. Authorize from the command line:

    opencode mcp auth k9

    This opens your browser to sign into your k9 account. This step is required. Opencode does not start the OAuth flow from inside its TUI, so if you skip it, k9 shows as "not connected."

  3. Confirm the connection: run opencode mcp list and k9 should show connected.

Notes

  • If you rename the server in opencode.json, re-run opencode mcp auth <new-name>, since stored tokens are keyed to the server name.
  • Manage auth with opencode mcp auth k9, opencode mcp list, and opencode mcp logout k9. Tokens are stored at ~/.local/share/opencode/mcp-auth.json.

VS Code (GitHub Copilot)

VS Code uses its own servers config key (not the mcpServers form). For a user-level (global) server, open the Command Palette and run MCP: Open User Configuration. This opens mcp.json in your VS Code profile folder. Then add a k9 server object under the servers key:

{
  "servers": {
    "k9": {
      "type": "http",
      "url": "https://mcp.k9security.io/mcp"
    }
  }
}

Workspace-level equivalent: put the same content in .vscode/mcp.json at your project root. For the full configuration reference, see the VS Code docs on adding an MCP server.

Then:

  1. VS Code shows a Start action above the server entry. Click it and approve the Trust prompt.
  2. VS Code opens a browser to sign into your k9 account. No API key.
  3. Use k9 from the Copilot Chat view in Agent mode. k9's tools appear in the tools picker, and the workflow prompts are available as slash commands (see below).

Using the k9 prompts in VS Code

In the Copilot Chat view, type / and pick the prompt using VS Code's MCP prefix, /mcp.k9.<prompt>:

  • /mcp.k9.fetch_dependency_alerts
  • /mcp.k9.score_dependency_alerts
  • /mcp.k9.fix_dependency_alerts
  • /mcp.k9.risk_scoring_rubric

k9's resources appear under the server entry's More… menu and via Add Context… → MCP Resources.

Use the Copilot Chat view, not the Agents window. VS Code's separate Agents window (Preview) runs Copilot CLI and Cloud agent sessions, which can only reach local MCP servers that do not require authentication. k9 is a remote, OAuth-authenticated server, so it is unreachable there: /mcp.k9.* prompts fail to resolve and the agent improvises its own steps instead. This is a VS Code client limitation. See the VS Code docs on Copilot CLI session limitations.

Other agents

Other MCP-capable agents (Cursor, OpenAI Codex CLI, Gemini CLI, and more) connect the same way. The endpoint and OAuth model are identical; only the config format and the auth trigger differ. Most read the generic mcpServers block above. For example, Cursor reads it from ~/.cursor/mcp.json (global) or .cursor/mcp.json (project).

If you get an agent connected and want us to document it here, reach out to support@k9security.io.

Score your first findings

In a repository with Dependabot alerts (or any CVE findings), ask your agent something like:

Please retrieve all of this project's open Dependabot alerts and score them for reachable risk.

Your agent gathers the findings and the reachability context; score_risk returns the FIX_TODAY / SCHEDULE / DEFER verdict with KEV + EPSS evidence. Your first scored finding starts the 7-day trial clock.

If your agent surfaces MCP prompts, you can run the same workflow as slash-command prompts instead of prose (see the per-agent sections above for the exact prefix).

Try k9 from a chat

You can also try k9 from a chat with no repository open, for example in claude.ai. Each of these prompts works there:

  1. "Use k9 to check whether CVE-2021-44228 and CVE-2026-42585 are known to be exploited in the wild, and what their EPSS scores are." k9 reports Log4Shell (CVE-2021-44228) as known exploited, including ransomware use, with an EPSS score near 1.0. CVE-2026-42585 is not in KEV and has a low EPSS score.
  2. "Look up the advisory details for GHSA-38f8-5428-x5cv." k9 returns the Netty HTTP request smuggling advisory, the affected io.netty:netty-codec-http versions, and the fixed versions.
  3. "Use k9 to score this dependency alert: io.netty:netty-codec-http 4.2.9.Final, GHSA-38f8-5428-x5cv, in an internet-facing, unauthenticated production API gateway (tier 2) where Netty's HTTP/1.1 request decoder parses every incoming request." score_risk returns a SCHEDULE verdict: the flaw is not known exploited, but it is reachable in an exposed, important service.
Last update: October 24, 2026