vulnfeed-mcp

VulnFeed is a dependency vulnerability monitoring MCP server designed for clients that support the MCP protocol, such as Claude Code. It can scan project dependencies for known vulnerabilities, prioritize them using EPSS exploit probability scores, and recommend fixed versions.

Main Capabilities

• Lock file parsing: Supports package-lock.json (npm), yarn.lock (Yarn), pnpm-lock.yaml (pnpm), requirements.txt (pip), Pipfile.lock (Pipenv), go.sum / go.mod (Go), Cargo.lock (Rust), Gemfile.lock (Ruby), composer.lock (PHP). Parses lock files to extract dependency names and versions.
• Vulnerability lookup: Queries OSV.dev (including GitHub Advisories and security databases for various ecosystems) for known CVEs.
• EPSS enrichment: Adds EPSS exploit probability scores to vulnerabilities.
• Smart filtering: By default suppresses low-priority CVEs (EPSS < 10% and CVSS < 9.0), which can reduce noise by about 80%. Pass show_all=True in any scanning tool to view all.
• Sorted by exploitability: The vulnerabilities most likely to be exploited are shown first.
• Fixed version recommendations: Returns fixed versions from the affected version ranges in each security advisory.

Usage

Add VulnFeed to your MCP client configuration (for Claude Code, ~/.claude/settings.json; for Claude Desktop, claude_desktop_config.json).

Free tier (no signup, no API key):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "npx",
      "args": ["-y", "vulnfeed-mcp"]
    }
  }
}

Paid version ($14 per month, unlimited scans + projects):

{
  "mcpServers": {
    "vulnfeed": {
      "command": "npx",
      "args": ["-y", "vulnfeed-mcp"],
      "env": {
        "VULNFEED_LICENSE_KEY": "your-license-key"
      }
    }
  }
}

License keys are available at vulnfeed.novadyne.ai.

Continuous Monitoring

• monitor_project: Creates a baseline snapshot of current dependencies and known vulnerabilities.
• check_alerts: Compares against the baseline and shows only new vulnerabilities.
• You can run check_alerts periodically, or pass webhook_url to let VulnFeed do it automatically.

When using webhooks (a paid feature: requires a license key, or for AI agents, x402 payment at $0.50 per project per 30 days), VulnFeed rescans the project every hour and POSTs new findings to the specified URL. Each delivery carries X-VulnFeed-Signature: sha256=<hex>, which is the HMAC-SHA256 signature computed over the raw request body using the webhook_secret returned once when the webhook was set up. Please verify this signature. Failed deliveries are retried in subsequent scans for about one day, after which they are discarded and counted. You can use set_webhook to rotate or remove the webhook.

x402 Micropayments

VulnFeed also accepts x402 micropayments—AI agents can pay per use with USDC on Base, with no API key or signup required. When the free tier limit is reached, the API returns HTTP 402 with payment requirements, and x402-compatible clients handle it automatically.

• $0.002 per CVE lookup
• $0.50 per project per 30 days for hourly webhook monitoring (renewable; the webhook receives an expiration event one day before expiration containing a renewal URL)

Use Cases

Suitable for developers using MCP clients such as Claude Code who want to automatically monitor project dependency vulnerabilities during development and prioritize high-risk issues based on actual exploit probability.

Limitations

• The free tier allows 10 scans per day and monitoring of 1 project.
• Single CVE lookups and webhooks require a license key or x402 payment.
• The paid version is $14 per month and provides unlimited scans and projects.
• Other feature details are not yet provided.