Categories › Security › Code & dependency scanning
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Remote server: your requests and data go to mcp.overflo.ws. Claude Code: claude mcp add --transport http overflo-ws https://mcp.overflo.ws/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
get_cve — Get one CVE's full detail: CVSS, weaknesses, references, products, affected/fixed versions, EPSS and KEV actions. Descriptions and URLs are find_package — Find open-source packages with known vulnerabilities or malicious package reports by name, or the start of one (lodash, log4j-core, tensorlacheck_package — Check one open-source package for everything known against it in one call: malicious package reports (malware published to the registry, whifind_product — Resolve a vendor or product prefix to NVD CPE names and CVE counts. Use first, then pass its vendor/product values to search_cves or its vencve_highlights — Get a public CVE briefing, the lists on overflo.ws's home page: headline stats, the 10 latest KEV additions, the 10 latest critical CVEs, anget_vendor — Get a vendor's total CVEs, KEV count and top 20 products by CVE count. Vendor/product names are NVD CPE names: call find_product first.search_cves — Search public CVEs by text, risk signals and affected products. Vendor/product must be NVD CPE names; call find_product first. KEV is the stNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.