Vulnerability Intelligence

An MCP application that puts vulnerability intelligence inside the assistant your team already uses. Ask what affects a product and version, research a single CVE, or review what changed this week.

Install from the docs

Open on GitHub

Open source. Stars and issues on GitHub genuinely shape what we build next.

Runs on

any MCP compatible assistant or agent

Requires

an MCP compatible client

Autonomy

read only

What it does.

Four operations, all read only.

Search discovers CVEs and CWEs from a description of a problem, a product or a technology, and returns a ranked mix of both. Retrieval takes an exact CVE, CWE or known alias and returns its full canonical document. Product lookup finds indexed CVEs by vendor, product, package, ecosystem and version, with applicability computed from normalised affected-product rows and structured version evidence rather than a name match. Recent listing returns what has been indexed or modified lately, filtered by product, vendor, severity, or whether exploitation is known.

Every record carries a CVSS score and qualitative severity, its mapped CWE identifiers, a lifecycle state of draft, stable or deprecated, a link to the upstream CVE record, and a SHA-256 hash of its content. Pagination is deterministic, so the same traversal returns the same results.

MCP is the protocol assistants use to call external tools. This runs as an MCP server, so the corpus is available inside the assistant your team already works in, rather than as another portal to log into.

What you get

Outcomes, not activity.

ApplicabilityMatched on version, not on nameProduct queries resolve against normalised affected-product rows and structured version evidence, so applicability is computed rather than guessed from a product string.

ProvenanceEvery record carries its sourceEach entry links to its upstream CVE record and carries a SHA-256 of its content, so an answer can be checked rather than taken on trust.

CurrencyReview what changed, not everythingRecently indexed and modified entries filter by product, vendor, severity or known exploitation, with deterministic pagination for repeatable review.

Get started

See it running against your own estate.

Book a demo