Categories › Security › Code & dependency scanning
Free CVE lookups, package checks and patch priorities from public sources. No account or API key.
Remote server: your requests and data go to vulnerable.now. Claude Code: claude mcp add --transport http vulnerable-now https://vulnerable.now/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
get_vulnerability — Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the descriptget_poc — List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, reget_overview — Get the stored AI-written overview of one CVE: one paragraph on what the flaw is, what it affects, what an attacker can do, whether it is exsearch — Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best get_package — Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that packget_product — Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with thelist_feed — List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit ctop_priority — What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activitcheck_stack — Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a loNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.