VulnFeed

authSTDIOregistry active

Summary

Scans project lockfiles for known vulnerabilities using OSV.dev data, enriched with EPSS exploit probability scores to cut through the noise. Supports nine ecosystems including npm, pip, Go, Rust, and Cargo. Nine tools let you scan entire projects or individual packages, look up CVE details with fix versions, and set up continuous monitoring that diffs against a baseline to surface only new vulnerabilities. Smart filtering suppresses low-EPSS, low-severity CVEs by default. Free tier gives you 10 scans per day with no signup. Paid tier is $14/month for unlimited scans, or pay per scan via x402 micropayments with USDC on Base.

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

inference shell

create and run specialised agents in minutes

build now →

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

inference shell

create and run specialised agents in minutes

build now →

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

Free tier — 10 scans/day, 1 monitored project, no signup required.

Homepage: vulnfeed.novadyne.ai

Install

uvx vulnfeed-mcp

MCP client config

Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):

Free tier (no signup, no API key):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"]
    }
  }
}

Paid ($14/mo, unlimited scans + projects):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"],
      "env": {
        "VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
      }
    }
  }
}

Get a license key at vulnfeed.novadyne.ai.

x402 micropayments

VulnFeed also accepts x402 micropayments — AI agents can pay per scan with USDC on Base, no API key or signup needed. When the free tier limit is reached, the API returns HTTP 402 with payment requirements that x402-compatible clients handle automatically.

$0.01 per scan
$0.002 per CVE lookup
$0.05 per project monitor setup

Tools

Scanning

Tool	Description
`scan_project`	Auto-detect and scan all lockfiles in a directory
`scan_lockfile`	Scan a specific lockfile
`check_package`	Check a single package for vulnerabilities
`lookup_cve`	Detailed CVE info with EPSS + fix versions

Monitoring

Tool	Description
`monitor_project`	Register for continuous monitoring
`check_alerts`	New vulns since last scan
`update_deps`	Update snapshot after upgrading packages
`list_monitored`	See all monitored projects
`unmonitor_project`	Remove from monitoring

Supported lockfiles

package-lock.json (npm)
yarn.lock (Yarn)
pnpm-lock.yaml (pnpm)
requirements.txt (pip)
Pipfile.lock (Pipenv)
go.sum / go.mod (Go)
Cargo.lock (Rust)
Gemfile.lock (Ruby)
composer.lock (PHP)

How it works

Parses your lockfile to extract dependency names + versions
Queries OSV.dev (NVD + GitHub Advisories) for known CVEs
Enriches with EPSS exploit probability scores
Filters noise — suppresses low-EPSS, non-critical CVEs by default
Sorts by exploitability — most likely to be exploited first
Returns fix version recommendations from package registries

Smart filtering

By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.

Pass show_all=True to any scan tool to see everything.

Continuous monitoring

monitor_project — takes a baseline snapshot of current deps + known vulns
check_alerts — diffs against baseline, surfaces only new vulns
Run check_alerts periodically to catch newly published CVEs

License

MIT

Featured

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

inference shell

create and run specialised agents in minutes

build now →

Configuration

VULNFEED_API_KEYsecret

Polar.sh license key for paid tier (optional — free tier works without it)

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

Free tier — 10 scans/day, 1 monitored project, no signup required.

Homepage: vulnfeed.novadyne.ai

Install

uvx vulnfeed-mcp

MCP client config

Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):

Free tier (no signup, no API key):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"]
    }
  }
}

Paid ($14/mo, unlimited scans + projects):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"],
      "env": {
        "VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
      }
    }
  }
}

Get a license key at vulnfeed.novadyne.ai.

x402 micropayments

$0.01 per scan
$0.002 per CVE lookup
$0.05 per project monitor setup

Tools

Scanning

Tool	Description
`scan_project`	Auto-detect and scan all lockfiles in a directory
`scan_lockfile`	Scan a specific lockfile
`check_package`	Check a single package for vulnerabilities
`lookup_cve`	Detailed CVE info with EPSS + fix versions

Monitoring

Tool	Description
`monitor_project`	Register for continuous monitoring
`check_alerts`	New vulns since last scan
`update_deps`	Update snapshot after upgrading packages
`list_monitored`	See all monitored projects
`unmonitor_project`	Remove from monitoring

Supported lockfiles

package-lock.json (npm)
yarn.lock (Yarn)
pnpm-lock.yaml (pnpm)
requirements.txt (pip)
Pipfile.lock (Pipenv)
go.sum / go.mod (Go)
Cargo.lock (Rust)
Gemfile.lock (Ruby)
composer.lock (PHP)

How it works

Parses your lockfile to extract dependency names + versions
Queries OSV.dev (NVD + GitHub Advisories) for known CVEs
Enriches with EPSS exploit probability scores
Filters noise — suppresses low-EPSS, non-critical CVEs by default
Sorts by exploitability — most likely to be exploited first
Returns fix version recommendations from package registries

Smart filtering

By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.

Pass show_all=True to any scan tool to see everything.

Continuous monitoring

monitor_project — takes a baseline snapshot of current deps + known vulns
check_alerts — diffs against baseline, surfaces only new vulns
Run check_alerts periodically to catch newly published CVEs

License

MIT

VulnFeed

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

Install

MCP client config

x402 micropayments

Tools

Scanning

Monitoring

Supported lockfiles

How it works

Smart filtering

Continuous monitoring

License

Configuration

VulnFeed

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

Install

MCP client config

x402 micropayments

Tools

Scanning

Monitoring

Supported lockfiles

How it works

Smart filtering

Continuous monitoring

License

Configuration

Related Security & Pentesting MCP Servers

Related Security & Pentesting MCP Servers