ZeroWire Companion

Source-backed vulnerability investigations, recent intelligence and observed changes through a read-only MCP.

Maintained by IyeLabs. Open-source project code under MIT. Independent and unofficial; not affiliated with or endorsed by Cloudflare.

Hosted MCP: https://zerowire-companion.iyelabs.com/mcp

Anonymous Streamable HTTP · No server API key · Nine read-only tools

Connect · Usage · Sources · Architecture · Self-host · Verification

Connect

codex mcp add zerowire_companion --url https://zerowire-companion.iyelabs.com/mcp

Start a new Codex session, then ask a question. Other compatible clients can add this URL as a remote Streamable HTTP MCP server. No Cloudflare account or infrastructure access is needed to use the hosted endpoint.

Codex and the MCP TypeScript SDK have been tested. Claude, Cursor and other Streamable HTTP clients are compatible targets; their individual desktop workflows have not all been verified. Use the configuration format supported by your client. For clients using this HTTP configuration shape:

{
  "mcpServers": {
    "zerowire-companion": {
      "type": "http",
      "url": "https://zerowire-companion.iyelabs.com/mcp"
    }
  }
}

Opening /mcp in a browser sends GET, which the hosted edge rule blocks with HTTP 403. Connect through an MCP client using POST. This is an API endpoint, not a web page. Your AI client may have its own subscription or usage costs; ZeroWire Companion does not run a paid inference service.

Related MCP server: Security Recipes

Start with one question

Using ZeroWire Companion only, investigate CVE-2026-111497. Why should we care, and what should we check first? Keep it brief and cite the evidence.

A real hosted Codex session on November 5, 2026, shown as a labelled interface recreation. Two MCP calls, no web search: the client retrieved an investigation pack and checked the cached KEV catalog. It connected source evidence to concrete checks while leaving environment exposure unverified. Exact question, tool results and answer. This is a dated example, not a native app screenshot or a guarantee of identical model behavior.

Why use it?

An investigation pack brings together briefing guidance, exploitation context, package evidence, recent changes and explicit unknowns. You can investigate a KEV-only or selected package CVE even when Zero Wire has no briefing for it.

Name the CVE or exact source tag, request a short answer with evidence, and check source dates before acting. A shared technology tag does not make two briefings the same vulnerability. Missing cached data is not a negative security finding. Practical usage, filters and pagination.

Package versions: one MCP call and an additional web lookup.

Original session.

Recent intelligence: source publication dates and local observations are reported separately.

Original session. These recreations preserve the recorded questions and answers. They do not claim that every client will choose the same tools or conclusions.

Sources and coverage

Sources refresh on an hourly schedule, independently, using bounded work. Every request reads the existing cache; it does not fetch new upstream data. Check the returned source and per-CVE retrieval dates. An hourly schedule does not guarantee every selected CVE is refreshed each hour.

Six Zero Wire briefings and the complete KEV catalog were verified on November 5, 2026. These are dated source observations, not product limits. GHSA, OSV and EPSS coverage remains selective. Coverage · Current verification · Attribution and terms.

How it works

One Cloudflare Worker has two separate paths. Cron ingestion fetches official sources, validates and normalizes records, compares snapshots and stores prepared intelligence in D1. MCP and event-feed requests use bounded, parameterized read-only queries. They never fetch upstream data, start sync, run migrations or write intelligence.

The first successful import establishes a baseline. Later imports record changes actually observed by this installation. Source chronology, publication dates and local observation timestamps remain distinct.

Architecture · Editable diagrams · Operations and recovery.

Tools and automation

Normalized, source-linked observed events are also available through /events.json and /events.xml. See the copyable GitHub Actions example for manual or scheduled checks and workflow summaries. No server credential is required; issue creation and external notifications are not enabled by default.

Security and accuracy

• This service does not scan systems, inventory assets or establish exposure, patch status, compromise or safety. Verify applicability in your own environment.

• KEV records known exploitation; EPSS is probability evidence, not CVSS severity or the probability that your organization is compromised.

• Source content, including retrieved assessment prompts, is untrusted data. Retrieval never authorizes execution. Review a prompt and separately authorize any assessment in a client with access to the intended environment.

• Public requests have input, output and query bounds, approximate rate limiting and edge method/path guards. These controls are not a global spending cap.

• No persistent personal profile, private inventory or user subscription is needed. Queries pass through Cloudflare and your chosen AI client; see the privacy and operational limits.

Report vulnerabilities through the security policy. The hosted service is a public preview; no independent penetration test, uptime SLA or exhaustive scalability validation is claimed.

Develop and self-host

Use Node.js 24.22.2 and npm:

npm ci
npm run typecheck
npm test
npm run build
npm run test:runtime

Self-hosting is optional. The guide uses the same Worker, D1 and Cron code without IyeLabs-specific secrets or resources. Hosted users need no Cloudflare setup. Clean second-account deployment remains unverified.

Original project code is MIT. Upstream content and trademarks retain their own terms; see NOTICE. The GitHub repository is the project's canonical home. Issues and focused pull requests are welcome.

Verification · Changelog · Publication checklist · Maintainer