scan_projectLABSCO SUMMARY
EPSS is what makes the list short enough to act on.
A scan that returns forty CVEs gets ignored. Ranking by exploit probability rather than severity alone puts the two that matter at the top, and the recommended fix version means the next step is an upgrade command rather than more research.
What it is
A dependency vulnerability server. It reads the lockfiles in a project, matches them against known CVEs, enriches each with its EPSS exploit-probability score, and recommends the version to upgrade to. It also keeps a snapshot so later runs report only what is new.
What you get
- Every lockfile in a directory found and scanned, or one specific lockfile on its own
- A single package checked without scanning a whole project
- Detailed CVE information with the EPSS score and the versions that fix it
- A project registered for continuous monitoring
- Only the vulnerabilities that are new since the last scan
- The snapshot updated after you upgrade, so the next report stays clean
- Monitored projects listed, and any of them removed from monitoring
Requirements
uvx vulnfeed-mcp — no signup on the free tier, which covers 10 scans a day and 1 monitored project. A paid monthly plan lifts both limits, unlocked by putting its key in the config. Agents can also pay per call over x402 in USDC on Base, priced separately for a scan, a CVE lookup and setting up a project monitor.
Setup effort
One command — uvx vulnfeed-mcp
USE CASES
01
Finding out what you are shipping
Scan the project directory and let it find every lockfile rather than naming them one by one.
02
Deciding whether a finding is urgent
Read the CVE in full with its EPSS score and the versions that fix it.
03
Checking one dependency before you add it
Ask about the single package instead of running a whole scan.
04
Not re-reading the same forty findings every week
Register the project, then ask only for what is new since the last scan.
05
Keeping the baseline honest after an upgrade
Update the snapshot once the packages are bumped, so the next alert is a real one.
06
Managing what is being watched
List the monitored projects and drop the ones you no longer ship.
9 tools
Listed in project docs. Your client may show a different list.
scan_lockfilecheck_packagelookup_cvemonitor_projectcheck_alertsupdate_depslist_monitoredunmonitor_projectBEFORE YOU INSTALL
What to know first
Tools you get
9 tools named in the project's documentation.
Requires
uvx on PATH
Optional
VULNFEED_API_KEY in your environment
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
uvx vulnfeed-mcpMCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": [
"vulnfeed-mcp"
]
}
}
}Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": [
"vulnfeed-mcp"
],
"env": {
"VULNFEED_API_KEY": "<YOUR_VULNFEED_API_KEY>"
}
}
}
}
