VulnFeed

Scans project lockfiles for known dependency vulnerabilities, scores them with EPSS exploit probability, and suggests fix versions.

What you can do

VulnFeed parses lockfiles from npm, Yarn, pnpm, pip, Pipenv, Go, Rust, Ruby and PHP projects to extract dependency names and versions, then queries OSV.dev for known CVEs and enriches results with EPSS exploit probability scores. Tools include scan_project, scan_lockfile, check_package and lookup_cve for scanning, plus monitor_project, check_alerts, set_webhook, update_deps, list_monitored and unmonitor_project for continuous monitoring. By default it suppresses low-priority CVEs (EPSS under 10% and CVSS under 9.0), which it says cuts noise by about 80%; show_all=True reveals everything.

When to use it

Use it when you want an assistant to check a project's dependencies for known vulnerabilities, prioritize them by likely exploitation, and get recommended fix versions. It is also useful for ongoing monitoring of a project, either by periodically running check_alerts or by registering a webhook for push alerts.

Requirements

Runs locally over stdio, installed with uvx vulnfeed-mcp, so a Python/uv runtime is needed. The free tier needs no signup or API key and allows 10 scans per day and 1 monitored project. Paid features (single-CVE lookup and webhooks) need a license key in the VULNFEED_API_KEY environment variable or x402 micropayment in USDC on Base. Network access to the VulnFeed API and OSV.dev is required.