Summary

Vulnerability knowledge delivered at generation time, in the file format your editor already enforces.

Two different shapes of the same data, and both are useful: security context injected per task, so the assistant sees the CVEs for the stack it is touching while it writes; and a guardrail file composed once and saved into the project, so the rules apply without any tool call at all. Prioritization is explicit — actively-exploited CVEs from the CISA KEV list outrank raw severity, with EPSS exploit probability behind it — and nothing needs a key because the catalog ships as committed JSON.

What it is

A catalog of CVEs and security rules, kept fresh by a daily pipeline over six public threat sources, exposed so an assistant can pull the relevant ones for the file it is editing and turn them into an IDE guardrail file.

What you get

The technology stack detected from a list of project files and directories, returned with a ready-to-use follow-up call
Security context for the task at hand: pass the file path and what is being built, get the matching rules and the CVEs that apply to that stack
A complete guardrail file generated for a stack and written in the shape your IDE expects — .cursor/rules for Cursor, CLAUDE.md for Claude Code, .windsurfrules for Windsurf
The 12 supported stacks listed with slug, name and ecosystem — Next.js, Express, FastAPI, NestJS, Nuxt, React SPA, Django, Rails, Go, iOS, Android and AI/LLM apps
CVE search across the catalog with filters for severity, stack, layer and OWASP reference, sorted by severity
One CVE in full: description, affected versions and the generated safe-code patterns for writing around it
The 15 protection layers the rules are organized under — auth_session, input_validation, api_security and the rest — and any rule's full content by slug
Catalog metadata: version, last update, and the counts of threats, rules, stacks and guardrails

Requirements

No account and no key to consume it. Run it with npx -y @aigently/mcp-server@latest over stdio. The server reads static JSON snapshots committed into the repository, so there is no database to stand up and no network call at query time. The keys listed in the project — an Anthropic API key, a GitHub token, an optional NVD key — are for running the ingest pipeline yourself, not for using the server. The catalog is refreshed by daily CI from NVD, CISA KEV, GHSA, OSV, npm Audit and EPSS.

Setup effort

One command — npx -y @aigently/mcp-server

Aigently