Free, read-only vulnerability intelligence merged from the CVE List, NVD, GitHub Advisory Database, OSV, ENISA EUVD, CISA KEV, FIRST EPSS and Exploit-DB. Seven tools search advisories, look up CVE/GHSA/EUVD/OSV IDs, check package and product versions, rank patch priorities, and check lockfiles, SBOMs or Wappalyzer exports. Results include source links, CVSS, EPSS, exploitation evidence and published fixes where available. No account or API key. Documentation: https://vulnerable.now/agents
Scored across 8 tools
Each tool targets a distinct resource or intent: stack/SBOM scan, single package, vendor product, vulnerability ID, feed, free-text search, PoC listing and priority ranking. The only near-collision is get_package vs get_product, whose descriptions are almost identical in phrasing and differ only by entity type (package vs vendor product), which an agent could plausibly misselect. Otherwise boundaries are explicitly stated and easy to follow.
Six of eight tools follow a clean verb_noun pattern (check_stack, get_package, get_poc, get_product, get_vulnerability, list_feed). The remaining two (search, top_priority) drop the verb or use a bare noun, which is a minor deviation rather than a different convention.
Eight tools for a vulnerability-intelligence server is well within the ideal range, and each one covers a genuinely different entry point (ID, package, product, stack, feed, search, priority, exploits). Nothing feels padded or redundant.
The surface covers the core lifecycle: discover (search, list_feed, top_priority), resolve by entity (package, product, stack), inspect details (get_vulnerability) and find exploits (get_poc), with batch ID lookup included. Minor gaps remain, such as no catalog/vendor enumeration or CWE-based browsing, but agents can work around these via search and filters.
Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a lockfile (package-lock.json, poetry.lock, go.sum and others), a CycloneDX or SPDX SBOM, a Wappalyzer export, or detected technologies such as nginx 1.18.0. Returns each finding with severity, exploitation, priority and fixed versions.
Inputs: file, packages, technologies. Returns: error, results, complete, packages, +4 more
Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that package. Give a version to learn which advisories affect it and the lowest upgrade that leaves every affecting range.
Inputs: name (required), ecosystem (required), sort, limit, +3 more. Returns: error, total, counts, package, +5 more
List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.
Inputs: id (required), limit, cursor, sources. Returns: id, url, pocs, error, +4 more
Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with the affected versions and fixes. The vendor is optional: with only a product name, a clear match is answered directly and otherwise the candidates are listed. Give a version to learn which entries affect it and the lowest upgrade that clears them.
Inputs: product (required), sort, limit, cursor, +3 more. Returns: error, total, counts, version, +6 more
Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the description, CVSS, CISA KEV status, EPSS, public exploits, affected packages, fixed versions, priority and source links.
Inputs: id, ids. Returns: error, missing, vulnerability, vulnerabilities
List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit code, fix availability, ecosystem, vendor, product, text and dates. Use modified_since to pick up changes since a previous run.
Inputs: kev, tech, limit, query, +12 more. Returns: error, next_cursor, vulnerabilities
Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.
Inputs: q (required), kev, sort, tech, +13 more. Returns: error, exact, total, next_cursor, +1 more
What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activity in a time window, optionally narrowed to an ecosystem, vendor or product.
Inputs: kev, limit, vendor, window, +2 more. Returns: error, window, vulnerabilities
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Add one secure layer between your agents and this server.
