Vulert is a software composition analysis (SCA) tool for software teams, whose core purpose is to detect known vulnerabilities in open source dependencies, without installing any agent and without accessing source code.
Main capabilities:
- Vulnerability detection: Upload a dependency manifest file or SBOM to find known vulnerabilities, view affected packages, severity, vulnerability context, and available fixes.
- Version-specific remediation guidance: The same issue may have different fixes in different versions. If an application uses version 8, Vulert shows the fix for version 8, not guidance for version 9 or 10.
- Continuous monitoring: Vulert continuously rechecks dependencies and alerts when newly disclosed vulnerabilities affect the application.
- CI/CD automation: Supports automating dependency scanning in CI/CD.
- API access: Version-specific remediation guidance is also available through the Vulert API.
- Coding agent integration: Vulert can be connected to Codex, Claude Code, Cursor, and other MCP-compatible agents. Agents can scan the latest dependency files and scan again after changes; dependencies are changed only when you ask.
- Portfolio management: View risk, recommended fixes, and monitoring status for all applications in one place.
- Compliance support: Maintain vulnerability history and reports for security, audit, and compliance reviews.
How to use: Upload a supported dependency file or SBOM format that the application already has, with no agent and no source code access required. After uploading, you can view vulnerabilities; after verifying your email, you can view the full report and start a 30-day free trial. The official statement says you can start a free scan within 60 seconds.
Use cases:
- Securing AI-assisted built applications: See which packages were introduced after AI-assisted changes and continuously monitor for known vulnerabilities.
- Compliance preparation: Maintain vulnerability history and reports for security, audit, and compliance reviews.
- Managing a growing application portfolio: Software vendors need a unified view of risk and monitoring status as the number of applications grows.
- Team needs: Keep up with AI-generated changes, provide evidence for security reviews, and manage an expanding application portfolio.
Limitations and notes:
- The official documentation does not provide a specific list of supported dependency files and SBOM formats, only stating that it supports dependency files the application already has.
- Regarding pricing, the official statement says you pay based on the number of monitored applications, with clear monthly pricing, but no specific prices are provided.
- Other feature details, platform support scope, and similar information are not yet provided.
