CVEs, affected versions and fix versions for your dependencies, from an affected-version ledger.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
VulnTracker API key as a bearer token. Create one at https://vulntracker.io/settings/api-keys (free account: 30 read-only calls a day).
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Add CVEs to the team's board (the API key's team) as cards, or update their status if a card already exists. Use after a scan when the user asks to put the findings on the board; write which dependency and version each CVE came from into notes. Up to 50 CVE ids per call, counted as one tool call. Ask the user before adding; never add unmatched or needs_confirmation findings without saying so.
CVE ids, e.g. ["CVE-2026-1234", "CVE-2026-2345"] (max 50)
Note written on every card, e.g. 'found by dependency scan of repo X: lodash 4.17.20'
Card status for all listed CVEs: new (default), acknowledged, in_progress, resolved, dismissed
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http mcp https://api.vulntracker.io/mcp \ --header 'Authorization: Bearer YOUR_TOKEN'
Headers
Authorization (required): VulnTracker API key as a bearer token. Create one at https://vulntracker.io/settings/api-keys (free account: 30 read-only calls a day).Add CVEs to the team's board (the API key's team) as cards, or update their status if a card already exists. Use after a scan when the user asks to put the findings on the board; write which dependency and version each CVE came from into notes. Up to 50 CVE ids per call, counted as one tool call. Ask the user before adding; never add unmatched or needs_confirmation findings without saying so.
| Argument | Type | Description |
|---|---|---|
| notes | string | Note written on every card, e.g. 'found by dependency scan of repo X: lodash 4.17.20' |
| status | string | Card status for all listed CVEs: new (default), acknowledged, in_progress, resolved, dismissed |
| cve_ids* | array | CVE ids, e.g. ["CVE-2026-1234", "CVE-2026-2345"] (max 50) |
{
"type": "object",
"required": [
"cve_ids"
],
"properties": {
"notes": {
"type": "string",
"description": "Note written on every card, e.g. 'found by dependency scan of repo X: lodash 4.17.20'"
},
"status": {
"type": "string",
"description": "Card status for all listed CVEs: new (default), acknowledged, in_progress, resolved, dismissed"
},
"cve_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "CVE ids, e.g. [\"CVE-2026-1234\", \"CVE-2026-2345\"] (max 50)"
}
},
"additionalProperties": false
}Check many product@version pairs in one call. Give the dependencies you read from the repository's manifests (go.mod, package.json / lock files, requirements.txt, pom.xml, Gemfile.lock, Cargo.lock, Dockerfile base images). For each one you get whether VulnTracker matched a product, whether the exact version is known, how many CVEs affect it, the newest affected CVEs with fix versions, and how confident the name match is. Max 50 items per call; batch larger lists.
| Argument | Type | Description |
|---|---|---|
| items* | array | Dependencies to check |
{
"type": "object",
"required": [
"items"
],
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"version"
],
"properties": {
"name": {
"type": "string",
"description": "Package or product name as it appears in the manifest, e.g. 'lodash', 'github.com/gin-gonic/gin', 'org.apache.logging.log4j:log4j-core', 'nginx'"
},
"version": {
"type": "string",
"description": "Installed version, e.g. '4.17.20' (strip ^ ~ v prefixes)"
},
"ecosystem": {
"type": "string",
"description": "Optional: npm, pypi, go, maven, cargo, rubygems, nuget, composer, docker"
}
},
"additionalProperties": false
},
"maxItems": 50,
"description": "Dependencies to check"
}
},
"additionalProperties": false
}The core question: which CVEs affect this exact version of a product, and which version fixes each? Returns (a) CVEs whose claims name this version, with evidence, confidence and fix versions, and (b) range_affected_cves: CVEs whose source gave a version range that contains this version (e.g. '3.0.0 to before 3.0.8'); affected_total adds both. all_versions_cves lists records whose source named no version at all, and shadowed_range_cves lists records where only an open-start '< X' entry covers this version while the same record also has an 'A..X' entry ending at the same X (one source gave a start, the other did not; the open-start entry may just be the same branch restated). An open-start entry whose end differs from every bounded entry is its own release line (node '<= 20.20.1' beside 22/24 lines) and counts as affected; neither is in affected_total, both need confirmation. fix_stated_by_source=false means the fix version was derived from a range bound, not stated by the vendor.
| Argument | Type | Description |
|---|---|---|
| role | string | 'affected' (CVEs affecting this version), 'fix' (CVEs this version fixes) or empty for both |
| limit | integer | Max CVEs (default 50, max 200) |
| product* | string | Product slug or id |
| version* | string | Exact version string as the product publishes it, e.g. '3.0.7', '7.4.2' |
{
"type": "object",
"required": [
"product",
"version"
],
"properties": {
"role": {
"type": "string",
"description": "'affected' (CVEs affecting this version), 'fix' (CVEs this version fixes) or empty for both"
},
"limit": {
"type": "integer",
"description": "Max CVEs (default 50, max 200)"
},
"product": {
"type": "string",
"description": "Product slug or id"
},
"version": {
"type": "string",
"description": "Exact version string as the product publishes it, e.g. '3.0.7', '7.4.2'"
}
},
"additionalProperties": false
}The team's CVE board: the CVEs that reached this team (by tracking notification or added by hand), each with its triage status (new, acknowledged, in_progress, resolved, dismissed), resolution status, notes, severity and the vendor/product it was recorded against. Use it to answer 'what is open on our board', 'which cards mention product X', or to find the card for a CVE.
| Argument | Type | Description |
|---|---|---|
| kev | boolean | Only cards whose CVE is in CISA KEV |
| page | integer | Page number, 1-based |
| limit | integer | Max cards (default 20, max 50) |
| query | string | CVE id prefix (CVE-2026-12) or free text matched against vendor/product/vulnerability name |
| status | string | Comma-separated card statuses: new, acknowledged, in_progress, resolved, dismissed. Empty = all non-archived |
| archived | boolean | Show archived cards instead of the live board |
| severity | string | critical, high, medium, low (comma-separated) |
| exploited | boolean | Only cards whose CVE has known exploitation |
The vendors, products, versions, CVEs, keywords and CPEs this account's team is watching in VulnTracker.
No arguments.
{
"type": "object",
"properties": {},
"additionalProperties": false
}Full record for one CVE: description, CVSS, EPSS, KEV/exploitation and SSVC, affected products with version ranges and fixes from the ledger, vendor advisories (CSAF), public exploit repositories, and VulnTracker's remediation guide when one is published.
| Argument | Type | Description |
|---|---|---|
| cve_id* | string | CVE id, e.g. CVE-2026-1234 |
{
"type": "object",
"required": [
"cve_id"
],
"properties": {
"cve_id": {
"type": "string",
"description": "CVE id, e.g. CVE-2026-1234"
}
},
"additionalProperties": false
}All CVEs recorded against a product in the affected-version ledger, newest first, with the version ranges each one names. entry_kind 'affected' = the product itself is vulnerable; 'runs_on_platform' = another product is vulnerable when running on it.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max CVEs (default 50, max 200) |
| offset | integer | Pagination offset |
| product* | string | Product slug or id |
| entry_kind | string | 'affected', 'affected_device', 'runs_on_platform' or empty for all |
{
"type": "object",
"required": [
"product"
],
"properties": {
"limit": {
"type": "integer",
"description": "Max CVEs (default 50, max 200)"
},
"offset": {
"type": "integer",
"description": "Pagination offset"
},
"product": {
"type": "string",
"description": "Product slug or id"
},
"entry_kind": {
"type": "string",
"description": "'affected', 'affected_device', 'runs_on_platform' or empty for all"
}
},
"additionalProperties": false
}List the versions VulnTracker knows for a product, with per-version CVE and fix counts. Use to find the exact version string before calling check_version.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max results (default 50, max 200) |
| search | string | Optional substring to filter versions, e.g. '3.0' |
| product* | string | Product slug (from search_products) or product id |
{
"type": "object",
"required": [
"product"
],
"properties": {
"limit": {
"type": "integer",
"description": "Max results (default 50, max 200)"
},
"search": {
"type": "string",
"description": "Optional substring to filter versions, e.g. '3.0'"
},
"product": {
"type": "string",
"description": "Product slug (from search_products) or product id"
}
},
"additionalProperties": false
}VulnTracker's published remediation guide for a CVE: summary, steps, workarounds, caveats, kind (fix / workaround / guidance) and the fix versions it rests on. Returns has_guide=false when none is published.
| Argument | Type | Description |
|---|---|---|
| cve_id* | string | CVE id |
{
"type": "object",
"required": [
"cve_id"
],
"properties": {
"cve_id": {
"type": "string",
"description": "CVE id"
}
},
"additionalProperties": false
}Search the CVE list with filters. Results are newest first. 'tracked_only' limits to CVEs matching the API key's team trackings.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max results (default 20, max 100) |
| query | string | Free text matched against CVE id prefix or vulnerability name |
| vendor | string | Vendor name filter |
| product | string | Product name filter |
| severity | string | critical, high, medium, low |
| exploited | boolean | Only CVEs with known exploitation (KEV / exploit evidence) |
| remediation | string | Only CVEs with a published VulnTracker guide of this kind: fix, workaround, guidance |
| tracked_only | boolean | Only CVEs matching this account's trackings |
| published_after | string | YYYY-MM-DD |
Find VulnTracker products (software, firmware, libraries) by name. Returns slugs to use with check_version, product_versions and product_cves. Searches display names and known aliases (package names, CPE tokens).
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max results (default 10, max 50) |
| query* | string | Product or package name, e.g. 'openssl', 'log4j', 'fortios' |
| vendor | string | Optional vendor slug or name to narrow the search |
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"description": "Max results (default 10, max 50)"
},
"query": {
"type": "string",
"description": "Product or package name, e.g. 'openssl', 'log4j', 'fortios'"
},
"vendor": {
"type": "string",
"description": "Optional vendor slug or name to narrow the search"
}
},
"additionalProperties": false
}Start watching something in VulnTracker for the API key's team: a product (default; slug or id from search_products / check_dependencies matched_slug), a vendor, a single CVE, or a keyword. New CVEs matching the tracking reach the team's board and its notification channels. Plan tracking limits apply; the error says so when the limit is reached. Use when the user asks to 'track', 'watch' or 'follow' the dependencies of a repository; prefer tracking products over individual CVEs.
| Argument | Type | Description |
|---|---|---|
| type | string | product (default), vendor, cve or keyword |
| notes | string | Optional note, e.g. 'used by repo X' |
| target* | string | Product/vendor slug or id, CVE id, or keyword text |
| min_severity | integer | Minimum severity to notify for: 0 all, 1 low, 2 medium, 3 high, 4 critical. Omit for the team default |
| exploited_only | boolean | Only notify when the CVE has known exploitation |
| version_filter | string | Optional version filter for a product, e.g. '>=3.0' |
{
"type": "object",
"required": [
"target"
],
"properties": {
"type": {
"type": "string",
"description": "product (default), vendor, cve or keyword"
},
"notes": {
"type": "string",
"description": "Optional note, e.g. 'used by repo X'"
},
"target": {
"type": "string",
"description": "Product/vendor slug or id, CVE id, or keyword text"
},
"min_severity": {
"type": "integer",
"description": "Minimum severity to notify for: 0 all, 1 low, 2 medium, 3 high, 4 critical. Omit for the team default"
},
"exploited_only": {
"type": "boolean",
"description": "Only notify when the CVE has known exploitation"
},
"version_filter": {
"type": "string",
"description": "Optional version filter for a product, e.g. '>=3.0'"
}
},
"additionalProperties": false
}Remove a tracking from the API key's team: give the same type and target used with track (or shown by list_trackings). Board cards stay.
| Argument | Type | Description |
|---|---|---|
| type | string | product (default), vendor, product_version, cve or keyword |
| target* | string | Product/vendor slug or id, CVE id, or keyword text |
{
"type": "object",
"required": [
"target"
],
"properties": {
"type": {
"type": "string",
"description": "product (default), vendor, product_version, cve or keyword"
},
"target": {
"type": "string",
"description": "Product/vendor slug or id, CVE id, or keyword text"
}
},
"additionalProperties": false
}Change one board card: triage status (new, acknowledged, in_progress, resolved, dismissed), resolution (patched, mitigated, workaround, accepted_risk, false_positive), notes and resolution notes. Creates the card if the CVE is not on the board yet. Use when the user says a CVE is fixed, accepted or a false positive.
| Argument | Type | Description |
|---|---|---|
| notes | string | Card notes (appended as the card's notes) |
| cve_id* | string | CVE id |
| status | string | new, acknowledged, in_progress, resolved, dismissed |
| resolution_notes | string | How it was resolved |
| resolution_status | string | patched, mitigated, workaround, accepted_risk, false_positive |
{
"type": "object",
"required": [
"cve_id"
],
"properties": {
"notes": {
"type": "string",
"description": "Card notes (appended as the card's notes)"
},
"cve_id": {
"type": "string",
"description": "CVE id"
},
"status": {
"type": "string",
"description": "new, acknowledged, in_progress, resolved, dismissed"
},
"resolution_notes": {
"type": "string",
"description": "How it was resolved"
},
"resolution_status": {
"type": "string",
"description": "patched, mitigated, workaround, accepted_risk, false_positive"
}
},
"additionalProperties": false
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 10, 2026.
| remediation | string | Only cards with a published VulnTracker guide of this kind: fix, workaround, guidance |
{
"type": "object",
"properties": {
"kev": {
"type": "boolean",
"description": "Only cards whose CVE is in CISA KEV"
},
"page": {
"type": "integer",
"description": "Page number, 1-based"
},
"limit": {
"type": "integer",
"description": "Max cards (default 20, max 50)"
},
"query": {
"type": "string",
"description": "CVE id prefix (CVE-2026-12) or free text matched against vendor/product/vulnerability name"
},
"status": {
"type": "string",
"description": "Comma-separated card statuses: new, acknowledged, in_progress, resolved, dismissed. Empty = all non-archived"
},
"archived": {
"type": "boolean",
"description": "Show archived cards instead of the live board"
},
"severity": {
"type": "string",
"description": "critical, high, medium, low (comma-separated)"
},
"exploited": {
"type": "boolean",
"description": "Only cards whose CVE has known exploitation"
},
"remediation": {
"type": "string",
"description": "Only cards with a published VulnTracker guide of this kind: fix, workaround, guidance"
}
},
"additionalProperties": false
}| published_before |
| string |
| YYYY-MM-DD |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"description": "Max results (default 20, max 100)"
},
"query": {
"type": "string",
"description": "Free text matched against CVE id prefix or vulnerability name"
},
"vendor": {
"type": "string",
"description": "Vendor name filter"
},
"product": {
"type": "string",
"description": "Product name filter"
},
"severity": {
"type": "string",
"description": "critical, high, medium, low"
},
"exploited": {
"type": "boolean",
"description": "Only CVEs with known exploitation (KEV / exploit evidence)"
},
"remediation": {
"type": "string",
"description": "Only CVEs with a published VulnTracker guide of this kind: fix, workaround, guidance"
},
"tracked_only": {
"type": "boolean",
"description": "Only CVEs matching this account's trackings"
},
"published_after": {
"type": "string",
"description": "YYYY-MM-DD"
},
"published_before": {
"type": "string",
"description": "YYYY-MM-DD"
}
},
"additionalProperties": false
}