VulnCheck

io.github.vulncheck-ossPublished by GitHub account vulncheck-ossv0.2.3Updated Oct 25, 2026

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

VulnCheck MCP server that lets an AI assistant look up CVEs, exploits, advisories and threat intelligence from VulnCheck inside the editor or terminal.

What you can do
Look up CVE details, severity, exploitability and affected versions for vulnerability research and triage. Check packages by CPE or PURL for known vulnerabilities before shipping. Determine whether a CVE has known exploit code, active exploitation or C2 indicators. Search vendor and ecosystem advisories by package, product or keyword. Query VulnCheck breach, botnet and threat intelligence indices for real-time context.
When to use it
Useful when reviewing code, triaging issues or assessing dependencies and you want vulnerability and exploit context without leaving the editor. Suited to security-minded developers and analysts who already have VulnCheck API access.
Requirements
A VulnCheck API token. Runs as a local process, installed from a release archive for macOS, Linux or Windows, or from the Docker image ghcr.io/vulncheck-oss/mcp. Network access to VulnCheck services.
Before you install
Requires a VulnCheck API token, which is a credential and may be tied to a paid subscription; keep it out of shared configuration. Queries are sent to VulnCheck's third-party services, so lookups reveal what you are investigating. The server is read-only lookup, but confirm tool behavior before relying on results.

Installation

In SourceWeft

  1. Open VulnCheck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[VulnCheck Logo]

The VulnCheck MCP Server

The VulnCheck MCP Server connects AI assistants to VulnCheck vulnerability intelligence. Ask your AI tools about CVEs, exploits, advisories, and vulnerable packages — directly in your editor or terminal, using natural language.

Use Cases

  • CVE research: Look up vulnerability details, severity, exploitability, and affected versions while reviewing code or triaging issues
  • Dependency analysis: Check packages by CPE or PURL to identify known vulnerabilities before shipping
  • Exploit intelligence: Determine whether a CVE has known exploit code, active exploitation, or C2 indicators
  • Advisory lookup: Search vendor and ecosystem advisories by package, product, or keyword
  • Index queries: Query VulnCheck's breach, botnet, and threat intelligence indices for real-time context

Requirements

  • A VulnCheck API token — create one here

Installation

Download the latest release from the Releases page, or use the Docker image (ghcr.io/vulncheck-oss/mcp).

PlatformArchive
macOS (Apple Silicon)vulncheck-mcp_1.2.3_darwin_arm64.tar.gz
macOS (Intel)vulncheck-mcp_1.2.3_darwin_amd64.tar.gz
Linuxvulncheck-mcp_1.2.3_linux_amd64.tar.gz
Windowsvulncheck-mcp_1.2.3_windows_amd64.zip

Install in Your AI Client

Available Tools

See docs/tools.md for the full list of available tools.

Development

bash
make build      # build for current platform → bin/vulncheck-mcpmake snapshot   # cross-compile all platforms via GoReleaser → dist/make test       # run testsmake lint       # run golangci-lint

Source: README.md at commit 6c8bdb9

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.3LatestOct 13, 2026
  2. v0.2.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Finance4 toolsOct 30, 2026

Zovo Charity Lookup

Published by GitHub account theluckystrike

Looks up US nonprofits by name or EIN and reports IRS status, Form 990 finances and officer pay from ProPublica Nonprofit Explorer.

Streamable HTTPWeb executable
Finance3 toolsNov 8, 2026

Zovo Bank Insurance Check

Published by GitHub account theluckystrike

Looks up US banks in live FDIC records and estimates how much of a user's deposits are FDIC insured.

Streamable HTTPWeb executable
Finance3 toolsNov 8, 2026

U.S. Public Company Check

Published by GitHub account JusticeUA

Remote Apify-hosted MCP server that lets an assistant look up U.S. public company checks by SEC CIK: filing status, bankruptcy 8-K flag, LEI and sanctions.

Streamable HTTPWeb executableAuth
FinanceCredential requiredNov 7, 2026