Skip to main content
Glama

vulners-mcp

by io.github.vulnersCom
OverviewDiscussionsAdmin

Server Details

MCP server for the Vulners.com API

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
vulnersCom/vulners-mcp
GitHub Stars
7
Server Listing
Vulners MCP Server

TDQS

Score is being calculated.

Available Tools

7 tools
audit_linux_packagesInspect

Linux package audit (RPM/DEB) for a given distro + version. Analyze Linux package vulnerabilities against the Vulners database.

ParametersJSON Schema
NameRequiredDescriptionDefault
osYesLinux distribution identifier (e.g., ubuntu, debian, centos, rhel, fedora). Use get_supported_os() to see available options.
packageYesInstalled packages, each formatted EXACTLY as the target OS's own package manager lists them -- i.e. one line of the output produced by the command get_supported_os() returns for this OS. DEB-based distros (ubuntu, debian, astra, linuxmint, ...): space-separated 'name version arch', e.g. 'openssl 3.0.2-0ubuntu1.6 amd64'. RPM-based distros (rhel, centos, oracle, almalinux, rocky, fedora, amazon, suse, ...): 'name-version-release.arch', e.g. 'openssl-1.0.2k-25.el7_9.x86_64'. The bare hyphenated 'name-version' short form is NOT accepted -- the API rejects it as 'Invalid package'.
versionYesDistribution version/release (e.g., 22.04, 12, 8, 40). Must match a supported version for the specified OS.
include_candidatesNoWhether to include potential matches in results. If None, uses default behavior (typically false).
audit_softwareInspect

🔍 VERSION-SPECIFIC SOFTWARE AUDIT 🔍 Audit specific software versions for known vulnerabilities. Use this when you have exact software version information (e.g., Chrome 138.0.7204.184). NEVER use search_lucene for version-specific software audits.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body containing software list and audit parameters. Should include 'software' array with structured CPE objects (NOT CPE strings) and optional 'match' parameter ('partial' or 'full'). Each CPE object has the CPE 2.3 fields: part, vendor, product, version, update, edition, language, sw_edition, target_sw, target_hw, other; vendor, product and version are required. USE THIS for specific software versions like 'Chrome 138.0.7204.184'.
bulletin_by_idInspect

🚨 PRIMARY TOOL FOR KNOWN IDs 🚨 Fetch a bulletin by CVE or Vulners ID. Returns a COMPACT triage-card summary by default -- id, title, CVSS3, EPSS, CVE list, and a compact exploitation/AI signal -- NOT the full record. Pass fields=[...] to widen (e.g. add 'description', 'cvss', 'cvss2', 'affectedSoftware') or references=True for the linked-bulletin graph; requesting everything can be very large. Supports single ID or list of IDs. When list is provided, references are automatically set to False. NEVER use search_lucene for known IDs.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesSingle CVE ID, Vulners ID, or bulletin ID to fetch, or a list of IDs. Supports CVE identifiers (CVE-2024-21762), vendor-specific IDs (RHSA-2024:1234), or Vulners internal IDs. When a list is provided, references are always False regardless of the `references` argument.
fieldsNoOverride the default COMPACT field projection to widen the response. Pass ['*'] to request every field Vulners has for the bulletin (can be very large for popular CVEs). Useful individual fields to add: 'description' (full prose description, dropped from the default), 'cvss'/'cvss2' (legacy score variants; the default already includes 'cvss3'), 'affectedSoftware'/'cnaAffected' (affected systems), 'enchantments' (the FULL AI/exploitation blob, including the large cross-reference and social-mention indexes the default omits). If omitted, the lean default is used: id, title, type, href, published, modified, bulletinFamily, cvss3, epss, cvelist, enchantments.exploitation, enchantments.score, enchantments.vulnersScore, enchantments.tags, enchantments.short_description.
referencesNoInclude the full reference graph (linked advisories, patches, related bulletins) for a SINGLE-ID lookup. Defaults to False: the compact default projection already covers the essentials (CVSS3, EPSS, exploitation signal, CVE list). Set True only when you need the reference graph and can accept a much larger response -- for heavily-referenced CVEs this can inflate the payload from a few KiB to 100+ MiB. Ignored (always False) when `id` is a list.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes
get_supported_osInspect

List supported OS identifiers/versions for Linux package audit. Get available operating systems for vulnerability analysis.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

query_autocompleteInspect

Autocomplete helper for search inputs (vendors, products, CVEs, etc.). Get search suggestions from the Vulners database.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body containing autocomplete parameters. Should include 'query' field with partial search term (e.g., 'openssl', 'CVE-2024-', 'microsoft windows').
search_cpeInspect

Find CPE strings by vendor+product (latest schema). Search for Common Platform Enumeration identifiers in the Vulners database.

ParametersJSON Schema
NameRequiredDescriptionDefault
sizeNoMaximum number of CPE results to return. If None, uses server default.
vendorYesVendor name to search for (e.g., 'microsoft', 'google', 'apache', 'oracle'). Case-insensitive.
productYesProduct name to search for (e.g., 'windows_10', 'chrome', 'http_server', 'java'). Case-insensitive.
search_luceneInspect

🔍 DISCOVERY TOOL FOR UNKNOWN VULNERABILITIES 🔍 Full-text search in Vulners Knowledge Base using Lucene syntax. Use ONLY when you don't have specific IDs or version information. NEVER use for known CVE/bulletin IDs - use bulletin_by_id instead. NEVER use for specific software versions (e.g., 'Chrome 138.0.7204.184') - use audit_software instead. 🚨 CRITICAL: For vendor/product searches, ALWAYS use cnaAffected.vendor and cnaAffected.product fields - the affectedSoftware field does NOT exist.

ParametersJSON Schema
NameRequiredDescriptionDefault
sizeNoMaximum number of results to return. Default is 20, hard-capped at 100 regardless of caller.
skipNoNumber of results to skip for pagination. Default is 0.
queryYesLucene query string for searching vulnerabilities. Supports Boolean operators (AND, OR, NOT), field-specific queries, range searches, and wildcard matching. NEVER use for specific software versions - use audit_software instead. For vendor/product searches use cnaAffected.vendor and cnaAffected.product (NOT affectedSoftware which does not exist).
fieldsNoOverride the default curated per-hit field projection. Pass ['*'] for every field per hit (large responses). If omitted, a curated default is used: id, title, type, cvss, cvss3, epss, published, href, cvelist.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updates
    • First observedaudit_linux_packages
    • First observedaudit_software
    • First observedbulletin_by_id
    • First observedget_supported_os
    • First observedquery_autocomplete
    • First observedsearch_cpe
    • First observedsearch_lucene

Related MCP Connectors

Related MCP Servers

Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources