cve.now MCP
A free vulnerability MCP server that merges CVE, GHSA, OSV, CISA KEV and EPSS into one entry and checks a project lockfile.
- 127 ★ on the repository
- Last commit
Extended access
Why this level
- The agent sends queries, package lists and project lockfile contents to an external service.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/cve-nowDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent sends queries, package lists and project lockfile contents to an external service.
This is third-party code. Review the repository files before installing.
What it does
cve.now merges the CVE List, the GitHub Advisory Database, OSV, NVD, the European EUVD, the CISA KEV catalog, EPSS scores and Exploit-DB into one entry per vulnerability. The data is open as RSS, Atom, JSON Feed and a JSON API with no account or key. The remote MCP server at `https://mcp.cve.now/mcp` gives an agent four tools. `search` queries by text and filters (severity, KEV, technology, package) and explains why a result matched. `get_vulnerability` shows an entry by CVE, GHSA or OSV id. `list_feed` returns the feed with the same filters. `check_stack` compares lockfile contents with the database and names the affected versions.
Who it is for. Developers and security engineers who ask an agent to check dependencies for known vulnerabilities before an upgrade.
Good fit when
- Before adding or upgrading a dependency, an agent calls `check_stack` on the lockfile.
- You need to know from a CVE id whether the vulnerability is in CISA KEV and which versions are fixed.
- A team subscribes to a feed of critical vulnerabilities for Next.js and npm.
- A rule to check dependencies through this server goes into `AGENTS.md` or `CLAUDE.md`.
Not a fit when
- The data concerns an undisclosed vulnerability: the service is public and issues are open to everyone.
- Lockfile contents cannot be sent to an external service.
- You need a code audit: the service knows published entries but does not scan source code.
Example request
Check the lockfile through cve.now and list vulnerabilities that affect the installed versions, starting with those in CISA KEV.MCP
- Transport
- http
- Authentication
- not required
Limitations
The service source code is closed: the repository holds only documentation and issues, and pull requests are not accepted. An empty result means cve.now found nothing and does not prove the packages are safe. Short entry summaries are written by a model and labelled as such, published under CC-BY 4.0. The technology list for the filter is limited; missing ones are requested through issues. Package lists and lockfiles go to the service's server, so account for that with private projects. The service is built and run by Sazabi.
How to disable. Remove the connection with `claude mcp remove cve-now` or delete the entry from the client configuration, then drop the rule from `AGENTS.md`.
FAQ
How do I connect cve.now to Claude Code?
Run `claude mcp add --transport http cve-now https://mcp.cve.now/mcp`. No key is needed. Then ask the agent to call `check_stack` on the lockfile.
How do I connect the server in Codex, Cursor or OpenCode?
For Codex run `codex mcp add cve-now --url https://mcp.cve.now/mcp`. For Cursor add the URL to `.cursor/mcp.json`, for OpenCode to `opencode.json` with the `remote` type.
Which lockfiles does the check understand?
They include `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `requirements.txt`, `poetry.lock`, `uv.lock`, `Cargo.lock`, `go.sum` and `composer.lock`. The full list is in the README.
Is an account or key required?
No. The feeds, the API and the MCP server are open without registration or a key.
Can I subscribe to a vulnerability feed?
Yes. `https://cve.now/feed` accepts the `filter`, `tech` and `ecosystem` filters, and the `format` parameter switches RSS, Atom or JSON. In Slack, `/feed subscribe` adds a feed.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
The MCP server gives agents Vulners vulnerability records, advisories and findings for installed software versions.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Bug Bounties MCP: vulnerability reward programs
bug-bounties-mcp
An MCP server that searches bug bounty and VDP programs and finds security contacts for sites, repos and packages
The official Socket MCP server scores the security of npm, PyPI, cargo and other dependencies inside an agent chat.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| cve.now (this card) | yes | not required | 127 | |
| CVE MCP Server | no | not required | 1,745 | a local MCP server analyses vulnerabilities from NVD, EPSS and KEV; cve.now is remote and keyless, with feeds and a lockfile check |
| Vulners MCP | yes | API key | 377 | Vulners data for an agent; cve.now merges eight open sources and needs no key |
README in short
The repository is the service's home on GitHub: what it is, how to connect and where to report problems. Data sources and licensing are listed at the end.