Vulners MCP
The MCP server gives agents Vulners vulnerability records, advisories and findings for installed software versions.
- 377 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Queries and software-version data reach Vulners; some methods consume paid account usage.
Install
- Works in
Manual install
pip install "vulners[mcp]"First command in AI agents (MCP); installs the server and its optional dependencies.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Queries and software-version data reach Vulners; some methods consume paid account usage.
This is third-party code. Review the repository files before installing.
What it does
Vulners MCP connects agents to vulnerability intelligence. Agents search advisories, inspect CVEs and match software versions against known issues. They can retrieve exploitation context or assess a user-supplied Linux package list. The server is an optional part of the official Vulners Python package. This local implementation exposes a core toolset, separate from the hosted service. It does not install fixes on assessed machines.
Who it is for. Vulnerability-management specialists matching their software versions to advisories and deciding what to investigate first.
Good fit when
- Your dependency list contains an outdated version whose CVEs need review.
- For a specific vulnerability, you need severity and exploitation context.
- An administrator has prepared a Linux package list for assessment.
- Before an upgrade, you gather vendor advisories for one product.
Not a fit when
- You want to run exploitation against a target automatically.
- Installed-software details must not reach an external service.
- You need hosted-service feature parity without checking the bundled toolset.
Example request
Check CVEs for this authorized package list and show source advisories without acting on servers.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
VULNERS_API_KEYrequired, secret- Vulners account API key.
Limitations
The local server needs Python 3.10 or later and the MCP package extra; the core package alone is insufficient. Supply a Vulners API key separately, with methods limited by account access. Software assessment sends product names and versions to Vulners, so submit only authorized inventories. Smart assessment of free-form names is billed per submitted string; check terms and test a few records before sending a large batch.
How to disable. Stop vulners-mcp and remove its client configuration. Revoke the Vulners key if it is no longer needed.
FAQ
How do I start it after installation?
Set `VULNERS_API_KEY` in the process environment and run `vulners-mcp`.
Must I install software on each assessed server?
No. You supply software and package data for matching against the Vulners database.
Why is a list incomplete?
The server caps long results and marks truncation. Request another page or specific fields.
Can I request a detailed bulletin?
Yes. Bulletin lookup supports selected fields or full output.
How does the hosted server differ?
Vulners operates it at a separate address; the bundled version provides core tools in your own environment.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
A free vulnerability MCP server that merges CVE, GHSA, OSV, CISA KEV and EPSS into one entry and checks a project lockfile.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
Bug Bounties MCP: vulnerability reward programs
bug-bounties-mcp
An MCP server that searches bug bounty and VDP programs and finds security contacts for sites, repos and packages
Damn Vulnerable MCP Server
Damn Vulnerable Model Context Protocol (DVMCP)
A deliberately vulnerable MCP server, a training lab of 10 challenges on attacks against MCP, run only in isolation
README in short
The SDK supports synchronous and asynchronous calls behind one MCP interface. Legacy and newer programming APIs have separate documentation.