Categories › Security › Code & dependency scanning
CVEs, affected versions and fix versions for your dependencies, from an affected-version ledger.
Remote server: your requests and data go to api.vulntracker.io. Claude Code: claude mcp add --transport http vulntracker https://api.vulntracker.io/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
add_to_board — Add CVEs to the team's board (the API key's team) as cards, or update their status if a card already exists. Use after a scan when the user check_dependencies — Check many product@version pairs in one call. Give the dependencies you read from the repository's manifests (go.mod, package.json / lock ficheck_version — The core question: which CVEs affect this exact version of a product, and which version fixes each? Returns (a) CVEs whose claims name this create_jira_issue — Open a Jira issue for a CVE on the team's board (the card is created first if missing) using the team's Jira integration. Returns the issue list_board_cards — The team's CVE board: the CVEs that reached this team (by tracking notification or added by hand), each with its triage status (new, acknowllist_trackings — The vendors, products, versions, CVEs, keywords and CPEs this account's team is watching in VulnTracker.lookup_cve — Full record for one CVE: description, CVSS, EPSS, KEV/exploitation and SSVC, affected products with version ranges and fixes from the ledgerproduct_cves — All CVEs recorded against a product in the affected-version ledger, newest first, with the version ranges each one names. entry_kind 'affectproduct_versions — List the versions VulnTracker knows for a product, with per-version CVE and fix counts. Use to find the exact version string before calling remediation_guide — VulnTracker's published remediation guide for a CVE: summary, steps, workarounds, caveats, kind (fix / workaround / guidance) and the fix vesearch_cves — Search the CVE list with filters. Results are newest first, up to 100 per call; when has_more is true pass next_cursor back as 'cursor' for search_products — Find VulnTracker products (software, firmware, libraries) by name. Returns slugs to use with check_version, product_versions and product_cvetrack — Start watching something in VulnTracker for the API key's team: a product (default; slug or id from search_products / check_dependencies matuntrack — Remove a tracking from the API key's team: give the same type and target used with track (or shown by list_trackings). Board cards stay.update_board_card — Change one board card: triage status (new, acknowledged, in_progress, resolved, dismissed), resolution (patched, mitigated, workaround, acceNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.