com.vulnrable/vulnrable

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Install

Remote server: your requests and data go to vulnrable.com. Claude Code: claude mcp add --transport http vulnrable https://vulnrable.com/api/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

• check_package — Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in
• list_mcp_servers — The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code
• check_cve — Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. U
• latest_vulns — Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ponytail-audit 190,451 ★
  Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
• ponytail-debt 190,451 ★
  Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
• security-and-hardening 117,221 ★
  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
• deal-with-security-advisory 113,505 ★
  Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, pr
• html-ppt-knowledge-arch-blueprint