A scan that returns forty CVEs gets ignored. Ranking by exploit probability rather than severity alone puts the two that matter at the top, and the recommended fix version means the next step is an upgrade command rather than more research.
A dependency vulnerability server. It reads the lockfiles in a project, matches them against known CVEs, enriches each with its EPSS exploit-probability score, and recommends the version to upgrade to. It also keeps a snapshot so later runs report only what is new.
- Every lockfile in a directory found and scanned, or one specific lockfile on its own
- A single package checked without scanning a whole project
- Detailed CVE information with the EPSS score and the versions that fix it
- A project registered for continuous monitoring
- Only the vulnerabilities that are new since the last scan
- The snapshot updated after you upgrade, so the next report stays clean
- Monitored projects listed, and any of them removed from monitoring
Uvx vulnfeed-mcp — no signup on the free tier, which covers 10 scans a day and 1 monitored project. A paid monthly plan lifts both limits, unlocked by putting its key in the config. Agents can also pay per call over x402 in USDC on Base, priced separately for a scan, a CVE lookup and setting up a project monitor.
One command plus a key — uvx vulnfeed-mcp, then supply credentials