VulnFeed — Dependency Vulnerability Monitoring for Claude Code

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

Free tier — 10 scans/day, 1 monitored project, no signup required.

Homepage: vulnfeed.novadyne.ai

Install

uvx vulnfeed-mcp

MCP client config

Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):

Free tier (no signup, no API key):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"]
    }
  }
}

Paid ($14/mo, unlimited scans + projects):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"],
      "env": {
        "VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
      }
    }
  }
}

Get a license key at vulnfeed.novadyne.ai.

Tools

Scanning

Monitoring

Supported lockfiles

• package-lock.json (npm)

• yarn.lock (Yarn)

• pnpm-lock.yaml (pnpm)

• requirements.txt (pip)

• Pipfile.lock (Pipenv)

• go.sum / go.mod (Go)

• Cargo.lock (Rust)

• Gemfile.lock (Ruby)

• composer.lock (PHP)

How it works

1. Parses your lockfile to extract dependency names + versions

2. Queries OSV.dev (NVD + GitHub Advisories) for known CVEs

3. Enriches with EPSS exploit probability scores

4. Filters noise — suppresses low-EPSS, non-critical CVEs by default

5. Sorts by exploitability — most likely to be exploited first

6. Returns fix version recommendations from package registries

Smart filtering

By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.

Pass show_all=True to any scan tool to see everything.

Continuous monitoring

1. monitor_project — takes a baseline snapshot of current deps + known vulns

2. check_alerts — diffs against baseline, surfaces only new vulns

3. Run check_alerts periodically to catch newly published CVEs

License

MIT