Vulnary-MCP

An MCP (Model Context Protocol) server for open-source vulnerability intelligence - look up CVEs and check packages against known vulnerabilities, directly from an MCP-compatible AI assistant.

Combines OSV.dev (open-source package vulnerabilities) and NVD (CVE database) into a small set of MCP tools.

Features

• 🔍 Look up a CVE by ID and get raw NVD data back

• 📦 Check a specific package/version for known vulnerabilities via OSV.dev

• 📋 Batch-check a list of dependencies in one call

• 🧩 Works with any MCP-compatible client (Claude Desktop, Claude Code, LM Studio, etc.)

Related MCP server: nvd-cve-mcp-server

Installation

git clone https://github.com/Agam-S/Vulnary-MCP
cd Vulnary-MCP
npm install
npm run build

Usage

Add it to your MCP client's config, pointing at the built entry point:

{
  "mcpServers": {
    "vulnary": {
      "command": "node",
      "args": ["/absolute/path/to/Vulnary-MCP/dist/index.js"]
    }
  }
}

Restart the client and the tools below should appear.

Tools

License

MIT License. See LICENSE for details.