now.vulnerablePublished by vulnerable.nowOfficial publisherv0.4.0Updated Nov 11, 2026
Free CVE lookups, package checks and patch priorities from public sources. No account or API key.
A free, no-key vulnerability catalog that lets an assistant look up CVEs and advisories, find public exploits, and rank what to patch first.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/now.vulnerable%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"vulnerable-now": {
"type": "http",
"url": "https://vulnerable.now/mcp"
}
}
}Look up vulnerabilities
Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the description, CVSS, CISA KEV status, EPSS, public exploits, affected packages, fixed versions, priority and source links.
ididsFind public exploits and proofs of concept
List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.
idrequiredlimitcursorsourcesSearch vulnerabilities
Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.
qrequiredkevsorttechlimitsinceuntilcursorvendorpackageproductseverity+5 moreLook up a package
Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that package. Give a version to learn which advisories affect it and the lowest upgrade that leaves every affecting range.
namerequiredsortlimitcursorversionecosystemrequiredonly_affectedLook up a product
Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with the affected versions and fixes. The vendor is optional: with only a product name, a clear match is answered directly and otherwise the candidates are listed. Give a version to learn which entries affect it and the lowest upgrade that clears them.
sortlimitcursorvendorproductrequiredversiononly_affectedList recent vulnerabilities
List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit code, fix availability, ecosystem, vendor, product, text and dates. Use modified_since to pick up changes since a previous run.
kevtechlimitquerysinceuntilcursorvendorpackageproductseverityecosystem+4 moreHighest-priority vulnerabilities
What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activity in a time window, optionally narrowed to an ecosystem, vendor or product.
kevlimitvendorwindowproductecosystemCheck dependencies, SBOMs and website technologies
Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a lockfile (package-lock.json, poetry.lock, go.sum and others), a CycloneDX or SPDX SBOM, a Wappalyzer export, or detected technologies such as nginx 1.18.0. Returns each finding with severity, exploitation, priority and fixed versions.
filepackagestechnologies83% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.