VulnFeed scans project dependencies for known CVEs, enriches results with EPSS exploit probability scores, and recommends fix versions.

Scanning

• scan_project — Auto-detect and scan all lockfiles in a project directory

• scan_lockfile — Scan a specific lockfile (npm, Yarn, pnpm, pip, Pipenv, Go, Rust, Ruby, PHP)

• check_package — Check a single package by name, version, and ecosystem (npm, PyPI, Go)

• lookup_cve — Get detailed info on a specific CVE or GHSA ID, including severity, EPSS score, affected versions, and fix recommendations

Continuous Monitoring

• monitor_project — Register a project for monitoring by taking a baseline snapshot

• check_alerts — Diff current vulnerabilities against the baseline to surface only new findings since last scan

• update_deps — Refresh a monitored project's dependency snapshot after upgrades

• list_monitored — View all projects registered for monitoring

• unmonitor_project — Remove a project from monitoring

Key Features

• Queries OSV.dev (NVD + GitHub Advisories) for CVE data

• Enriches results with EPSS exploit probability scores

• Smart filtering suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0) by default, reducing noise by ~80%; override with show_all=True

• Sorts results by exploitability (most dangerous first) and provides fix version recommendations

Scans composer.lock files to detect known vulnerabilities in PHP dependencies and recommend fix versions.

Scans npm package-lock.json files to detect known vulnerabilities in dependencies and recommend fix versions.

Scans pnpm-lock.yaml files to detect known vulnerabilities in dependencies and recommend fix versions.

Scans pip requirements.txt and Pipfile.lock files to detect known vulnerabilities in Python dependencies and recommend fix versions.

Scans Gemfile.lock files to detect known vulnerabilities in Ruby dependencies and recommend fix versions.

Scans Cargo.lock files to detect known vulnerabilities in Rust dependencies and recommend fix versions.

Scans yarn.lock files to detect known vulnerabilities in dependencies and recommend fix versions.