CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
Raw package.json contents
Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex.
[{name, version}] entries
Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
| Argument | Type | Description |
|---|---|---|
| manifest | string | Raw package.json contents |
| ecosystem | string | Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex. |
| dependencies | array | [{name, version}] entries |
{
"type": "object",
"required": [],
"properties": {
"manifest": {
"type": "string",
"description": "Raw package.json contents"
},
"ecosystem": {
"type": "string",
"description": "Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex."
},
"dependencies": {
"type": "array",
"items": {
"type": "object"
},
"description": "[{name, version}] entries"
}
}
}Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.
| Argument | Type | Description |
|---|---|---|
| cve_id* | string | CVE identifier, e.g. CVE-2021-44228 (case-insensitive; a bare 2021-44228 also works). |
{
"type": "object",
"required": [
"cve_id"
],
"properties": {
"cve_id": {
"type": "string",
"description": "CVE identifier, e.g. CVE-2021-44228 (case-insensitive; a bare 2021-44228 also works)."
}
}
}Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.
| Argument | Type | Description |
|---|---|---|
| cve_id | string | A single CVE id. |
| cve_ids | array | Multiple CVE ids (or pass a comma-separated string). |
{
"type": "object",
"required": [],
"properties": {
"cve_id": {
"type": "string",
"description": "A single CVE id."
},
"cve_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Multiple CVE ids (or pass a comma-separated string)."
}
}
}Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.
| Argument | Type | Description |
|---|---|---|
| limit | number | When listing, how many newest entries to return (default 20, max 100). |
| cve_id | string | Optional. Check a single CVE, e.g. CVE-2021-44228. |
| vendor | string | Optional. Filter by vendor or product name substring. |
| ransomware_only | boolean | Optional. Only vulns CISA links to known ransomware campaigns. |
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "number",
"description": "When listing, how many newest entries to return (default 20, max 100)."
},
"cve_id": {
"type": "string",
"description": "Optional. Check a single CVE, e.g. CVE-2021-44228."
},
"vendor": {
"type": "string",
"description": "Optional. Filter by vendor or product name substring."
},
"ransomware_only": {
"type": "boolean",
"description": "Optional. Only vulns CISA links to known ransomware campaigns."
}
}
}List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
| Argument | Type | Description |
|---|---|---|
| name* | string | Exact package name as published in that registry, e.g. lodash for npm, requests for pypi. |
| version | string | Optional; if given, only vulns affecting that version are returned |
| ecosystem* | string | Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex. |
{
"type": "object",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Exact package name as published in that registry, e.g. lodash for npm, requests for pypi."
},
"version": {
"type": "string",
"description": "Optional; if given, only vulns affecting that version are returned"
},
"ecosystem": {
"type": "string",
"description": "Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex."
}
}
}