Vulnfeed
About
Dependency vulnerability scanner with EPSS exploit scoring. Scans lockfiles, prioritizes by actual exploit probability, recommends fix versions. 9 MCP tools. Free tier + $14/mo subscription + x402 micropayments.
Details
- Author
- infai-tech
- Downloads
- 197
- Categories
- Developer Tools, Security, Infrastructure, Other
Jump to
- Reads 9 lockfile formats (package-lock.json, requirements.txt, go.sum, Cargo.lock, etc.)
- Queries NVD and GitHub Advisory Database for known CVEs
- Enriches findings with Exploit Prediction Scoring System (EPSS) scores
- Recommends exact fix versions from package registries
- Supports continuous monitoring with alerts for new CVEs
- 9 tools for scanning, checking, and managing projects
- Free tier available with 10 scans/day and 1 monitored project
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
VulnfeedCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Vulnfeed is an MCP server that can be run locally (stdio transport) or remotely (SSE transport). After installation, it provides 9 tools for scanning lockfiles, checking individual packages, looking up CVEs, and managing continuous monitoring. The free tier requires no signup and allows 10 scans per day and 1 monitored project; paid subscriptions are available.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"vulnfeed": {
"vulnfeed": {
"command": "uvx",
"args": [
"vulnfeed-mcp"
]
}
}
}
}McpServers
{
"vulnfeed": {
"command": "uvx",
"args": [
"vulnfeed-mcp"
]
}
}VulnFeed — Dependency Vulnerability Monitoring for Claude Code
An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.
Free tier— 10 scans/day, 1 monitored project, no signup required.
Add to your MCP client config (~/.claude/settings.jsonfor Claude Code,claude_desktop_config.jsonfor Claude Desktop):
{ "mcpServers": { "vulnfeed": { "command": "uvx", "args": ["vulnfeed-mcp"] } } }
Paid($14/mo, unlimited scans + projects):
{ "mcpServers": { "vulnfeed": { "command": "uvx", "args": ["vulnfeed-mcp"], "env": { "VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE" } } } }
Get a license key atvulnfeed.novadyne.ai.
- $0.01 per scan
- $0.002 per CVE lookup
- $0.05 per project monitor setup
- package-lock.json(npm)
- yarn.lock(Yarn)
- pnpm-lock.yaml(pnpm)
- requirements.txt(pip)
- Pipfile.lock(Pipenv)
- go.sum/go.mod(Go)
- Cargo.lock(Rust)
- Gemfile.lock(Ruby)
- composer.lock(PHP)
- Parses your lockfile to extract dependency names + versions
- Queries OSV.dev (NVD + GitHub Advisories) for known CVEs
- Enriches with EPSS exploit probability scores
- Filters noise — suppresses low-EPSS, non-critical CVEs by default
- Sorts by exploitability — most likely to be exploited first
- Returns fix version recommendations from package registries
By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.
Passshow_all=Trueto any scan tool to see everything.
- monitor_project— takes a baseline snapshot of current deps + known vulns
- check_alerts— diffs against baseline, surfaces only new vulns
- Runcheck_alertsperiodically to catch newly published CVEs
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Enable AI agents to secure code with Semgrep.
An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.
AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.
MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.
Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.
BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.
A secure MCP server for executing controlled command-line operations with comprehensive security features.
Access the Codacy API to analyze code quality, coverage, and security for your repositories.
Execute pre-approved shell commands securely on a server.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
