VulnFeed is an MCP server that scans project dependencies for known vulnerabilities, enriches findings with EPSS exploit-probability scores, and monitors projects for new CVEs over time.
Scan a lockfile (scan_lockfile) — reads a specific package-lock.json, requirements.txt, go.sum, etc., and returns a prioritized report with fix versions
Scan a whole project (scan_project) — auto-detects and scans every lockfile in a directory, skipping node_modules, .git, and vendor
Check one package (check_package) — vulnerabilities for a single package by name/version in the npm, PyPI, or Go ecosystem
Look up a CVE/GHSA (lookup_cve) — full details: severity, EPSS score, affected packages, fix versions, references
Filter noise — low-priority CVEs (EPSS < 10% and CVSS < 9) are suppressed by default; pass show_all=True to see all
Register for monitoring (monitor_project) — takes a baseline snapshot of deps and known vulns
Check alerts (check_alerts) — diffs against the baseline to surface only new (and newly resolved) vulns
Update after upgrades (update_deps) — refreshes the dependency snapshot while preserving vuln history
Manage monitored projects (list_monitored, unmonitor_project) — see or delete monitored projects
Note: lookup_cve and webhook monitoring are paid features (license key or x402 micropayments); the README's set_webhook tool is not exposed in this schema.
Scans composer.lock files to detect known vulnerabilities in PHP dependencies and recommend fix versions.
Scans npm package-lock.json files to detect known vulnerabilities in dependencies and recommend fix versions.
Scans pnpm-lock.yaml files to detect known vulnerabilities in dependencies and recommend fix versions.
Scans pip requirements.txt and Pipfile.lock files to detect known vulnerabilities in Python dependencies and recommend fix versions.
Scans Gemfile.lock files to detect known vulnerabilities in Ruby dependencies and recommend fix versions.
Scans Cargo.lock files to detect known vulnerabilities in Rust dependencies and recommend fix versions.
Scans yarn.lock files to detect known vulnerabilities in dependencies and recommend fix versions.
An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.
Free tier — 10 scans/day, 1 monitored project, no signup required. Single-CVE lookup and webhooks need a license key or x402.
Homepage: vulnfeed.novadyne.ai
uvx vulnfeed-mcpAdd to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):
Free tier (no signup, no API key):
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": ["vulnfeed-mcp"]
}
}
}Paid ($14/mo, unlimited scans + projects):
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": ["vulnfeed-mcp"],
"env": {
"VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
}
}
}
}Get a license key at vulnfeed.novadyne.ai.
VulnFeed also accepts x402 micropayments — AI agents can pay per scan with USDC on Base, no API key or signup needed. When the free tier limit is reached, the API returns HTTP 402 with payment requirements that x402-compatible clients handle automatically.
$0.01 per scan
$0.002 per CVE lookup
$0.50 per project per 30 days of hourly webhook monitoring (renewable; the webhook receives an expiring event with the renew URL a day before)
Related MCP server: locklens
Tool | Description |
| Auto-detect and scan all lockfiles in a directory |
| Scan a specific lockfile |
| Check a single package for vulnerabilities |
| Detailed CVE info with EPSS + fix versions (license key or x402) |
Tool | Description |
| Register for continuous monitoring (optional |
| New vulns since last scan |
| Set, rotate or remove a project's webhook |
| Update snapshot after upgrading packages |
| See all monitored projects |
| Remove from monitoring |
package-lock.json (npm)
yarn.lock (Yarn)
pnpm-lock.yaml (pnpm)
requirements.txt (pip)
Pipfile.lock (Pipenv)
go.sum / go.mod (Go)
Cargo.lock (Rust)
Gemfile.lock (Ruby)
composer.lock (PHP)
Parses your lockfile to extract dependency names + versions
Queries OSV.dev (GitHub Advisories plus each ecosystem's security database) for known CVEs
Enriches with EPSS exploit probability scores
Filters noise — suppresses low-EPSS, non-critical CVEs by default
Sorts by exploitability — most likely to be exploited first
Returns fix versions from each advisory's affected-version ranges
By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.
Pass show_all=True to any scan tool to see everything.
monitor_project — takes a baseline snapshot of current deps + known vulns
check_alerts — diffs against baseline, surfaces only new vulns
Either run check_alerts periodically, or pass webhook_url and let VulnFeed do it
With a webhook (a paid feature: a license key, or for agents x402 at $0.50 per project per 30-day term), VulnFeed re-scans the project every hour and POSTs new findings to your URL:
{
"event": "vulnfeed.new_vulns",
"delivery_id": "…", "project_id": "…", "project_name": "…", "sent_at": "…",
"count": 1,
"new_vulns": [{ "id": "GHSA-…", "package": "express", "version": "4.18.2", "severity": "HIGH",
"epss": { "score": 0.42 }, "fix_version": "4.19.2", "summary": "…" }],
"alerts_url": "https://vulnfeed-api.novadyne.ai/vulnscan/alerts?project=…"
}Every delivery carries X-VulnFeed-Signature: sha256=<hex>, the HMAC-SHA256 of the raw body under
the webhook_secret returned once when the webhook was set. Verify it. Failed deliveries are retried
on later sweeps for about a day, then dropped and counted. Rotate or remove the webhook with
set_webhook.
MIT
Check for new vulnerabilities since the last scan of a monitored project.
Compares current vulnerability data against the stored baseline. Returns new vulnerabilities (not seen before) and resolved ones (previously known, no longer present).
Args: project_id: The project ID returned by monitor_project.
Inputs: project_id (required). Returns: result
Check a single package for known vulnerabilities.
Args: name: Package name (e.g. "express", "django", "golang.org/x/net"). version: Package version (e.g. "4.18.2", "3.2.0"). ecosystem: Package ecosystem — "npm", "PyPI", or "Go". Defaults to "npm". show_all: Show all vulnerabilities including low-priority ones.
Inputs: name (required), version (required), ecosystem, show_all. Returns: result
List all projects registered for vulnerability monitoring.
Shows project names, IDs, package counts, and registration dates.
Inputs: no named parameters. Returns: result
Look up detailed information about a specific vulnerability.
Returns full details including severity, EPSS exploit probability, affected packages, fix versions, and references.
Args: cve_id: Vulnerability ID (e.g. "CVE-2024-29041", "GHSA-rv95-896h-c2vc").
Inputs: cve_id (required). Returns: result
Register a project for continuous vulnerability monitoring.
Scans the project's lockfiles, records the current vulnerability baseline, and stores a snapshot. Use check_alerts later to see new vulnerabilities that appeared since registration.
Args: project_path: Path to the project root. Defaults to current directory. project_name: Human-readable name for the project. Defaults to directory name.
Inputs: project_path, project_name. Returns: result
Scan a lockfile for known vulnerabilities.
Reads a package lockfile (package-lock.json, requirements.txt, go.sum), queries NVD + GitHub Advisories, enriches with EPSS exploit probability, and returns a prioritized vulnerability report with fix recommendations.
By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9). Set show_all=True to see every vulnerability.
Args: lockfile_path: Absolute path to the lockfile to scan. show_all: Show all vulnerabilities including low-priority ones.
Inputs: lockfile_path (required), show_all. Returns: result
Auto-detect and scan all lockfiles in a project directory.
Walks the project directory looking for lockfiles (package-lock.json, requirements.txt, go.sum, etc.) and scans each one. Skips node_modules, .git, and vendor directories.
By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9).
Args: project_path: Path to the project root. Defaults to current directory. show_all: Show all vulnerabilities including low-priority ones.
Inputs: project_path, show_all. Returns: result
Remove a project from vulnerability monitoring.
Deletes the stored dependency snapshot and vulnerability baseline.
Args: project_id: The project ID to remove.
Inputs: project_id (required). Returns: result
Update a monitored project's dependency snapshot after upgrading packages.
Re-reads lockfiles from the project directory and updates the stored dependency list. Preserves vulnerability history: existing known vulns that still apply are kept; new vulns from upgraded deps are flagged; vulns from removed deps are marked resolved.
Args: project_id: The project ID to update. project_path: Path to the project root. Defaults to current directory.
Inputs: project_id (required), project_path. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 9 tools
Each tool targets a distinct resource and action: scanning lockfiles vs. whole projects, looking up packages vs. CVEs, and monitoring lifecycle actions like register, update, check, list, and unmonitor. Even the scanning tools are clearly separated by scope (single lockfile vs. project directory).
All tool names follow a consistent snake_case verb_noun pattern: scan_lockfile, scan_project, check_package, lookup_cve, monitor_project, update_deps, check_alerts, list_monitored, unmonitor_project. The pattern makes the set predictable and easy to navigate.
Nine tools is well-scoped for a vulnerability scanning and monitoring server. Each tool earns its place, covering scanning, lookup, registration, alerting, updating, listing, and removal without unnecessary duplication.
The tool surface covers the core lifecycle well: scan, lookup, monitor, update baselines, check alerts, list, and unmonitor. A minor gap is the lack of a direct way to retrieve the full stored vulnerability baseline for a monitored project, though scanning again or check_alerts can work around it.
Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.
Patchwire is a free, read-only MCP server for security advisories on modern JS, AI and web3 stacks. It reads maintainers' own advisories and vendor security posts every hour, often days before they reach the GitHub Advisory Database, and returns vulnerable ranges, fixed versions per release line and the conditions that make each flaw exploitable. Send package names, never versions. No account, no key.
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
Real-time FIRST.org EPSS 30-day CVE exploit probability scoring and OSV package security audit.
