VulnFeed
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VULNFEED_API_KEY | No | Your license key for paid tier (unlimited scans and projects). Get one at https://vulnfeed.novadyne.ai |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_lockfileA | Scan a lockfile for known vulnerabilities. Reads a package lockfile (package-lock.json, requirements.txt, go.sum), queries NVD + GitHub Advisories, enriches with EPSS exploit probability, and returns a prioritized vulnerability report with fix recommendations. By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9). Set show_all=True to see every vulnerability. Args: lockfile_path: Absolute path to the lockfile to scan. show_all: Show all vulnerabilities including low-priority ones. |
| check_packageA | Check a single package for known vulnerabilities. Args: name: Package name (e.g. "express", "django", "golang.org/x/net"). version: Package version (e.g. "4.18.2", "3.2.0"). ecosystem: Package ecosystem — "npm", "PyPI", or "Go". Defaults to "npm". show_all: Show all vulnerabilities including low-priority ones. |
| lookup_cveA | Look up detailed information about a specific vulnerability. Returns full details including severity, EPSS exploit probability, affected packages, fix versions, and references. Args: cve_id: Vulnerability ID (e.g. "CVE-2024-29041", "GHSA-rv95-896h-c2vc"). |
| scan_projectA | Auto-detect and scan all lockfiles in a project directory. Walks the project directory looking for lockfiles (package-lock.json, requirements.txt, go.sum, etc.) and scans each one. Skips node_modules, .git, and vendor directories. By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9). Args: project_path: Path to the project root. Defaults to current directory. show_all: Show all vulnerabilities including low-priority ones. |
| monitor_projectA | Register a project for continuous vulnerability monitoring. Scans the project's lockfiles, records the current vulnerability baseline, and stores a snapshot. Use check_alerts later to see new vulnerabilities that appeared since registration. Args: project_path: Path to the project root. Defaults to current directory. project_name: Human-readable name for the project. Defaults to directory name. |
| check_alertsA | Check for new vulnerabilities since the last scan of a monitored project. Compares current vulnerability data against the stored baseline. Returns new vulnerabilities (not seen before) and resolved ones (previously known, no longer present). Args: project_id: The project ID returned by monitor_project. |
| list_monitoredA | List all projects registered for vulnerability monitoring. Shows project names, IDs, package counts, and registration dates. |
| update_depsA | Update a monitored project's dependency snapshot after upgrading packages. Re-reads lockfiles from the project directory and updates the stored dependency list. Preserves vulnerability history: existing known vulns that still apply are kept; new vulns from upgraded deps are flagged; vulns from removed deps are marked resolved. Args: project_id: The project ID to update. project_path: Path to the project root. Defaults to current directory. |
| unmonitor_projectB | Remove a project from vulnerability monitoring. Deletes the stored dependency snapshot and vulnerability baseline. Args: project_id: The project ID to remove. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool targets a distinct resource and action: scanning lockfiles vs. whole projects, looking up packages vs. CVEs, and monitoring lifecycle actions like register, update, check, list, and unmonitor. Even the scanning tools are clearly separated by scope (single lockfile vs. project directory).
All tool names follow a consistent snake_case verb_noun pattern: scan_lockfile, scan_project, check_package, lookup_cve, monitor_project, update_deps, check_alerts, list_monitored, unmonitor_project. The pattern makes the set predictable and easy to navigate.
Nine tools is well-scoped for a vulnerability scanning and monitoring server. Each tool earns its place, covering scanning, lookup, registration, alerting, updating, listing, and removal without unnecessary duplication.
The tool surface covers the core lifecycle well: scan, lookup, monitor, update baselines, check alerts, list, and unmonitor. A minor gap is the lack of a direct way to retrieve the full stored vulnerability baseline for a monitored project, though scanning again or check_alerts can work around it.