Aigently

12 stacks · 6 sources · daily CI · MCP-native · Apache 2.0 · 0 keys required to consume.

CVE published → pipeline detects it → Claude generates safe-code patterns → rule committed to this repo → your IDE enforces it while you type

AI coding assistants write production code fast. They don't know which CVEs landed last week, or how to write around them. Aigent.ly bridges that gap: it turns a live CVE feed into IDE rules that travel with your project,enforced at generation time — not discovered at audit time.

- AI assistants don't know which CVEs landed last week.
- SAST catches issues at audit time. Aigent.ly catches them atgeneration time.
- Free, open data. Private, paid product. The security boundary is by design.

No API keys needed to consume. CI commits fresh snapshots daily — point your IDE at the MCP server and you're done.

Add to your IDE's MCP config — works with Claude Code, Cursor, Windsurf, Copilot, and Cline:

Every threat in the catalog carries multiple ranking signals so the MCP layer can surface the CVEs that actually matter:

final_rank = isActivelyExploited (CISA KEV) ← ground truth: it's being exploited NOW + severity (CVSS bucket) ← classic theoretical severity + epssScore ≥ 0.5 (+1) / ≥ 0.9 (+2) ← prediction: how likely 30-day exploitation + family match (owasp_web | owasp_llm) ← keep LLM threats from polluting web rankings + intent overlap (auth/inject/csrf/rag) ← what the developer is actually doing

EPSS is the difference between "CVSS 9.8 — patch in the next sprint" and "CVSS 9.8 with EPSS 0.94 — drop everything." We expose both.

Theai-llmstack ingests CVEs against the AI application toolchain and classifies them against theOWASP LLM Top 10instead of the Web Top 10:

Watched packages:langchain,langchain-community,langchain-core,llama-index,llama-index-core,llama-cpp-python,transformers,huggingface_hub,vllm,gradio,ollama,anthropic,openai,pydantic-ai,crewai,autogen-agentchat,dspy-ai.

Threats from this stack flow through a dedicated LLM-aware prompt inamplify-threats.tsso guardrails are framed in LLM vocabulary (NEVER concatenate retrieved context into the system prompt without delimiters) rather than web vocabulary.

Daily CI run (GitHub Actions, 06:00 UTC) Phase 0 CISA KEV map + stack registry preflight Phase 1–3 npm Audit + OSV + GHSA → raw advisories Phase 5 deduplicate (source-priority based) Phase 4a EPSS exploit-probability enrichment ← NEW (batched, 50 CVEs/req) Phase 4 NVD: backfill CVSS & CWE for low-confidence rows Phase 6–8 upsert threats + per-stack mapping + mitigation flags Phase 9 close sync log Amplify Claude: 2–4 ALWAYS/NEVER patterns per CVE (family-aware prompt) Summarize Claude: cluster CVEs into per-stack rule docs Synthesize Claude: merge into pre-built guardrail blocks (patterns + deps) Export write JSON snapshots to packages/catalog-data/ Commit auto-push catalog-data/ to this repo

git clone https://github.com/aelbuni/aigently-catalog cd aigently-catalog npm install cp pipeline/.env.example pipeline/.env # default DATABASE_URL matches docker-compose npm run db:setup # start Postgres, migrate, seed

# pipeline/.env — keys you need only when running the pipeline yourself: ANTHROPIC_API_KEY=... # required for amplify, summarize, synthesize GITHUB_TOKEN=... # required for GHSA source NVD_API_KEY=... # optional — increases NVD rate limit 10× # EPSS requires no key. npm run sync:threats # ingest CVEs from all six sources npm run amplify:threats # Claude: ALWAYS/NEVER patterns per CVE (family-aware) npm run summarize:rules # Claude: cluster into per-stack rule docs npm run synthesize:guardrails # Claude: pre-build guardrail blocks npm run export:catalog # write JSON to packages/catalog-data/

- Node.js 22+
- Docker (for local Postgres)
- Anthropic API key (AI pipeline steps only)

Already shipped: 12 stacks · 6 sources · EPSS-ranked prioritization · family-aware (web + LLM) amplifier prompts.

- PoC / exploit-availability detection— GitHub + Exploit-DB + Nuclei templates
- Vendor advisories— MSRC + Red Hat + Ubuntu (for base-image / OS-level CVEs)
- STIX 2.1 export— for SIEM ingestion
- KEV / EPSS watchlist webhooks— alert when a CVE in your detected stack moves into KEV or above an EPSS threshold
- Spring Boot, Laravel, .NET stacks— open to contribution

PRs are welcome. The highest-value contributions are:

Apache 2.0 — threat data sourced from public domain (NVD, CISA KEV, GHSA, OSV, EPSS).

"We open-sourced everything the community needs — the data, the pipeline, the stack registry. The web app that runs aigent.ly is private. Because a security product should practice what it preaches."

Aigent.ly and the Aigent.ly logo are trademarks of Aigently, Inc.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.

Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.

BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.

A secure MCP server for executing controlled command-line operations with comprehensive security features.

Access the Codacy API to analyze code quality, coverage, and security for your repositories.