Cline & Roo Code

Cline and its fork Roo Code are VS Code extensions with their own MCP support and their own settings file, separate from VS Code’s.

Add it

{
  "mcpServers": {
    "vulnetix": {
      "type": "streamableHttp",
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey <orgId>:<hex>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Save. Both extensions reload MCP config on save, with no restart needed.

Confirm it works

The MCP Servers panel shows vulnetix green with an expandable tool list.

Look up GHSA-jfh8-c2jp-5v3q and tell me whether it is being exploited.

On auto-approve

autoApprove lists tools that run without asking. It is empty above on purpose.

Every Vulnetix tool is read-only and none of them touch your filesystem, so auto-approving them is not dangerous in itself. The reason to think twice is different: seeing each call is how you notice the agent looking up the wrong package, or burning quota in a loop. Approval prompts are cheap feedback.

If you do want a few unattended, the safest are the pure lookups:

"autoApprove": ["vulnetix_vuln", "vulnetix_kev_status", "vulnetix_package_search"]

Worth knowing

Act mode. Tools are called in Act mode; Plan mode reasons without executing.

Per-server tool toggles. Both extensions let you disable individual tools in the panel, which helps if your model gets distracted by having 31 available.

Roo tracks Cline closely but menu labels drift between versions. If a path above does not match, look for “MCP” in the extension’s settings.

Troubleshooting

Server shows red. Validate the JSON, and confirm type is streamableHttp.

Nothing happens after saving. Toggle disabled to true and back to false to force a reconnect.

401 in every result. Both halves of the key: ApiKey <orgId>:<hex>.