now.vulnerable由 vulnerable.now 發布官方發布者v0.4.0更新於 Nov 11, 2026
Free CVE lookups, package checks and patch priorities from public sources. No account or API key.
免費的漏洞目錄服務，不需金鑰，讓助理查詢 CVE 與安全公告、尋找公開的漏洞利用程式碼，並排出修補優先順序。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/now.vulnerable%2Fmcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"vulnerable-now": {
"type": "http",
"url": "https://vulnerable.now/mcp"
}
}
}Look up vulnerabilities
Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the description, CVSS, CISA KEV status, EPSS, public exploits, affected packages, fixed versions, priority and source links.
ididsFind public exploits and proofs of concept
List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.
id必填limitcursorsourcesSearch vulnerabilities
Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.
q必填kevsorttechlimitsinceuntilcursorvendorpackageproductseverity另有 5 個Look up a package
Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that package. Give a version to learn which advisories affect it and the lowest upgrade that leaves every affecting range.
name必填sortlimitcursorversionecosystem必填only_affectedLook up a product
Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with the affected versions and fixes. The vendor is optional: with only a product name, a clear match is answered directly and otherwise the candidates are listed. Give a version to learn which entries affect it and the lowest upgrade that clears them.
sortlimitcursorvendorproduct必填versiononly_affectedList recent vulnerabilities
List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit code, fix availability, ecosystem, vendor, product, text and dates. Use modified_since to pick up changes since a previous run.
kevtechlimitquerysinceuntilcursorvendorpackageproductseverityecosystem另有 4 個Highest-priority vulnerabilities
What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activity in a time window, optionally narrowed to an ecosystem, vendor or product.
kevlimitvendorwindowproductecosystemCheck dependencies, SBOMs and website technologies
Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a lockfile (package-lock.json, poetry.lock, go.sum and others), a CycloneDX or SPDX SBOM, a Wappalyzer export, or detected technologies such as nginx 1.18.0. Returns each finding with severity, exploitation, priority and fixed versions.
filepackagestechnologies已滿足適用檢查項的 83%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請宣告包含 README 的 GitHub 儲存庫，或在 OAuth 受保護資源後設資料中提供 resource_documentation。
託管服務按其提供方的條款使用，因此這裡不要求授權條款。此檢查項不計入百分比。