What is the cve.now remote MCP server?
The cve.now remote MCP server is a hosted Model Context Protocol endpoint at https://mcp.cve.now/mcp, so AI assistants can connect to it without installing or running anything locally.
cve.now MCP ServerVerifiedFeatured
@Sazabi
Basic information
Transport
Streamable HTTP
Authentication
None
Category
Developer Tools
Author
Sazabi
Submitted by
Sherwood Callaway
About cve.now MCP Server
Free, public vulnerability feed for coding agents. One deduplicated entry per CVE, GHSA or OSV id, merged from the CVE List, GitHub Advisories, OSV, NVD, CISA KEV, EPSS and Exploit-DB. check_stack scans a lockfile for known vulnerabilities. No login, no API key.
Connection details
https://mcp.cve.now/mcpSetup
claude mcp add cve-now --transport http https://mcp.cve.now/mcpcve.now MCP Server tools
5Get one vulnerability entry by CVE, GHSA or OSV id, as JSON. Includes CISA SSVC decision points (exploitation, automatable, technicalImpact) when CISA published them, and, when cve.now has read the vendor advisory, context (a plain sentence, sourced conditions, vendor severity, fix, FAQ) with exposure: Actively exploited, Default setups, Specific setups only or Unclear.
List the newest items in a cve.now feed. Pass name for one stored feed (critical, all, kev, tech/<slug>, ecosystem/<eco>; critical when nothing is passed), or any of filter, tech and ecosystem to narrow it. Each of those takes one value or a list: an item must match any listed value of a field, and every field passed. Up to 16 combinations of values.
Check exact package versions against cve.now's synced vulnerability catalog. Pass a lockfile, a package list, or the stack_id of a lockfile uploaded to cve.now. For a large lockfile, upload it instead of passing its contents: curl --data-binary @<file> -H 'X-Lockfile-Name: <file name>' https://cve.now/api/stack returns its id. A flake.lock is checked by the git commit each input pins, through OSV, and its nixpkgs package CVEs are not checked. No matches means none found, not a guarantee of safety.
Get the cve.now Index: the worst CVEs published or escalated this week, month or year, or of all time (window all: every CVE ever in KEV or with a Metasploit module, plus the past year), ranked by a 0-100 score (exploitation 40, exposure 25, reach 20, severity 10, no patch 5; methodology at https://cve.now/leaderboard/methodology). Narrow with tech, ecosystem and filter (critical, kev); a row matches any listed value of a field and every field passed. Pass week (YYYY-Www) instead, without tech, ecosystem or filter, for an archived week's top 25. Week rows carry movement since the previous week.
Search cve.now's vulnerabilities and early warnings with advisory.dev's query language: free text, "quoted phrases" and ids, plus keys such as vendor:, package:, affects:lodash@4.17.20, severity:, cvss:>=9, kev:true, epss:, published:<30d, type:cve|early_warning, tech:, confidence: and category:, and sort:relevance|published|modified|cvss. Terms are ANDed, commas OR values, a leading - excludes. Unverified early warnings appear only with confidence:unverified. Pass next_cursor back as cursor for the next page.
Overview
What is cve.now?
A free vulnerability feed that merges the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB into one entry per vulnerability.
Tools
- get_vulnerability: one CVE/GHSA/OSV entry: severity, affected versions, fixes, exploitation
- list_feed: newest entries, filtered by critical, KEV, technology or ecosystem
- check_stack: check a lockfile or package list for known vulnerabilities
- get_leaderboard: the cve.now Index, the worst CVEs this week
- search: find entries by keyword
Try it
"Run check_stack on this project's lockfile and list any known vulnerabilities."
Frequently asked questions
How do I connect to the cve.now MCP server?
Add the endpoint https://mcp.cve.now/mcp to any MCP-compatible client such as Claude Code, Cursor, or VS Code. The setup snippets on this page configure each client in one step.
Does the cve.now MCP server require authentication?
No. cve.now's MCP server does not require authentication — you can connect directly with the endpoint URL.
Which transport does the cve.now MCP server use?
cve.now exposes a Streamable HTTP endpoint, the transport used by remote MCP servers and supported by all major MCP clients.
More remote MCP servers
2pr.io
Write, schedule and publish LinkedIn posts in your own voice, reply to comments and read your analytics, all from your AI assistant. Remote MCP server with OAuth sign-in.
AdWhispr - Research, Clone, & Launch Ads from Claude/ChatGPT
Remote MCP server that turns Claude, ChatGPT, or Cursor into a full ad workflow: research any brand's live Facebook and TikTok ads, clone the proven winners for your own brand, and launch real campaigns on Google, TikTok
AQL PropertyCheck — Physical check of one exact address
Check one exact Gold Coast or Brisbane City property address. Free address/coverage check and short summary; paid structured Agent JSON adds available building, street and surrounding context, with Brisbane routed journe
AWS Knowledge MCP Server
Search and read current AWS documentation, check regional availability and load AWS agent skills, with no AWS account needed.
AIsa
AIsa is one key for 950+ data APIs across SEO and AI visibility, finance, social, web search, sales and agent mail — the go-to-market data stack behind prospecting, competitor research and brand monitoring. Five tools ra
Comments