pwned.coffee

Working Security A

coffee.pwned/pwned-coffeev1.0.0 Domain verified

Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks.

Security

Watch Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://pwned.coffee/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

check_lockfile Read-only

Match the packages and versions in a lockfile against incidents that state fixed versions, and print a receipt: what you use, the version, affected or not, and the exact upgrade. Accepts package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, go.sum, go.mod, Cargo.lock, Gemfile.lock, a Dockerfile, an .nvmrc / .node-version ("node") or a GitHub Actions workflow ("actions"). For several files at once, use check_repo.

contentstring, required

The lockfile text, as-is.

ecosystemstring

Which reader to use. "auto" detects from the content. "node" is an .nvmrc or .node-version file, "actions" a GitHub Actions workflow.

Tools (6)

check_lockfile

read-only

Argument	Type	Description
content*	string	The lockfile text, as-is.
ecosystem	string	Which reader to use. "auto" detects from the content. "node" is an .nvmrc or .node-version file, "actions" a GitHub Actions workflow.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "content"
  ],
  "properties": {
    "content": {
      "type": "string",
      "maxLength": 3000000,
      "minLength": 1,
      "description": "The lockfile text, as-is."
    },
    "ecosystem": {
      "enum": [
        "auto",
        "npm",
        "pypi",
        "composer",
        "go",
        "cargo",
        "rubygems",
        "docker",
        "node",
        "actions"
      ],
      "type": "string",
      "default": "auto",
      "description": "Which reader to use. \"auto\" detects from the content. \"node\" is an .nvmrc or .node-version file, \"actions\" a GitHub Actions workflow."
    }
  }
}

check_repo

Send the files that describe what a project runs (lockfiles, Dockerfiles, .github/workflows/*.yml, wrangler.toml, vercel.json, next.config.*, compose files) in one call. Returns one receipt: every affected package with the exact command to fix it in the tool the repo already uses, actions and images to check, and live incidents for the detected stack that the files cannot rule out.

read-only

Argument	Type	Description
files*	array	Up to 40 files. Paths matter: they pick the reader and the fix command.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "files"
  ],
  "properties": {
    "files": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "path",
          "content"
        ],
        "properties": {
          "path": {
            "type": "string",
            "maxLength": 300,
            "minLength": 1,
            "description": "Repo-relative path, e.g. \"apps/web/package-lock.json\""
          },
          "content": {
            "type": "string",
            "maxLength": 3000000
          }
        }
      },
      "maxItems": 40,
      "minItems": 1,
      "description": "Up to 40 files. Paths matter: they pick the reader and the fix command."
    }
  }
}

diff_since

Every correction, new ticket and fix-status change since a point in time, each with the source behind it (the same log as /corrections). Use it to audit what the board changed since your last run. Accepts an ISO 8601 timestamp, or "24h", "7d", "90m".

read-only

Argument	Type	Description
since*	string	An ISO 8601 timestamp like 2026-10-24T00:00:00Z, or "24h", "7d"
stack	array	Optional stack ids to filter by.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "since"
  ],
  "properties": {
    "since": {
      "type": "string",
      "maxLength": 40,
      "minLength": 2,
      "description": "An ISO 8601 timestamp like 2026-10-24T00:00:00Z, or \"24h\", \"7d\""
    },
    "stack": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 60,
      "description": "Optional stack ids to filter by."
    }
  }
}

lookup_cve

The incident covering a CVE or GHSA id, or a named bug (e.g. HTTP2Shell): summary, severity, patch status, fixed versions, timeline and sources.

read-only

Argument	Type	Description
id*	string	e.g. CVE-2026-12345, GHSA-xxxx-xxxx-xxxx or HTTP2Shell

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "maxLength": 40,
      "minLength": 4,
      "description": "e.g. CVE-2026-12345, GHSA-xxxx-xxxx-xxxx or HTTP2Shell"
    }
  }
}

todays_specials

Live security incidents right now (CVEs, breaches, supply-chain compromises) with severity, patch status, fixed versions and ids. Pass stack ids to see only what touches your stack. Known ids: nextjs, react, node, bun, php, python, ruby, go, java, wordpress, drupal, magento, perl, proof-tools, dotnet, rust, npm, pypi, github-actions, docker, vscode, browser-ext, linux, linux-services, openssh, nginx, apache, kubernetes, postgres, mysql, redis, gitlab, ci, atlassian, self-hosted, selfhost-apps, paas, cloudflare, aws, gcp, azure, vps, databases-cloud, ai-gateways, ai-keys, ml-infra, mcp, chrome, apple, android, windows, office, password-managers, messaging, crypto-wallets, vpn-edge, ics, remote-support, vmware, security-tools, health-it, erp.

read-only

Argument	Type	Description
stack	array	Stack ids to filter by, e.g. ["nextjs","npm"]. Omit for everything.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "stack": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 60,
      "description": "Stack ids to filter by, e.g. [\"nextjs\",\"npm\"]. Omit for everything."
    }
  }
}

whats_new

Incidents created or updated since a point in time, newest first. Use it to re-check only what changed since your last run. Accepts "24h", "7d", "90m" or an ISO timestamp.

read-only

Argument	Type	Description
since*	string	"24h", "7d", or an ISO timestamp like 2026-10-23T08:00:00Z
stack	array	Optional stack ids to filter by.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "since"
  ],
  "properties": {
    "since": {
      "type": "string",
      "maxLength": 40,
      "minLength": 2,
      "description": "\"24h\", \"7d\", or an ISO timestamp like 2026-10-23T08:00:00Z"
    },
    "stack": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 60,
      "description": "Optional stack ids to filter by."
    }
  }
}

pwned.coffee

Try it

check_lockfile Read-only

pwned.coffee

Try it

check_lockfile Read-only

Install

Tools (6)

Security checkA100/100