vulnfeedby Novadyne

Know when your dependencies are vulnerable.

An MCP server that reads your lockfile, checks NVD + GitHub Advisories, and tells you what actually matters — prioritized by real-world exploit probability, with exact fix versions.

Free tier — 10 scans/day, no signup. $14/mo for unlimited.

Building an agent instead of shipping code yourself? VulnFeed is also a keyless, pay-per-call CVE & EPSS feed over x402 — your agent hits a 402, pays a few cents in USDC, and gets structured, exploit-ranked results. No account, no API key, no subscription. Agent API →

> Scan my project for vulnerabilities
Using: scan_project(".")

Scanning package-lock.json... 847 packages

GHSA-29mw-wpgm-hmr9 in express@4.17.1
  Severity: HIGH | EPSS: 73.2% (HIGH) | Fix: upgrade to 4.21.0
  Open redirect via malicious URL in res.location()

CVE-2024-29041 in express@4.17.1
  Severity: MODERATE | EPSS: 0.8% (low) | Fix: upgrade to 4.19.2

3 affected packages, 12 vulnerabilities total
Top priority: express — the GHSA-29mw vuln has 73% exploit probability

Why not just ask Claude to check?

It knows your deps

Reads your package-lock.json, requirements.txt, or go.sum and filters to only the CVEs that hit your actual dependency tree. No noise from packages you don't use.

EPSS prioritization

Most CVEs are noise. EPSS (Exploit Prediction Scoring System) scores each one by real-world exploitability. VulnFeed surfaces the ones likely to be used in real attacks.

Fix recommendations

Not just "you're vulnerable" but upgrade express 4.17.1 → 4.21.0. Cross-references npm, PyPI, and Go registries for the exact version that fixes the issue.

Continuous monitoring

Register your project once. Check back any time for new vulnerabilities. New CVE published at 3am? It's in the index by 3:15am for your morning session.

9 tools, one install

Scan a lockfile, check a package, look up a CVE, monitor a project, check alerts, update deps, list projects. Everything a security workflow needs.

Zero upstream cost

Data sources are NVD, GitHub Advisory DB, and EPSS — all free, public APIs. No vendor lock-in, no data broker middlemen. Your $14 pays for the intelligence layer, not data access.

How it compares

Free MCP servers Snyk / Socket VulnFeed
CVE lookup
Knows your deps
EPSS prioritization
Fix recommendations
Continuous monitoring
MCP-native
Free tier ✓ (10 scans/day)
x402 micropayments ✓ ($0.01/scan)
Price (paid) Free $25-49/dev/mo $14/mo flat

Setup in 2 minutes

Free tier — no signup, no API key

10 scans/day, 1 monitored project. Just add this to your MCP config:

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"]
    }
  }
}

Works in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf.

Restart your client. Ask it to scan my project for vulnerabilities. That's it.

Unlimited — $14/mo

Unlimited scans, unlimited monitored projects. Add your license key:

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["vulnfeed-mcp"],
      "env": {
        "VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
      }
    }
  }
}

Get your license key — flat rate, not per-seat, not per-repo.

Pay-per-scan — x402 micropayments

AI agents can pay per request with USDC on Base — no account, no API key, no subscription. Your agent gets a 402 response, pays $0.01, and gets results. Works with any x402-compatible client.

# Agent sends request, gets HTTP 402 with payment details
# x402 client library handles payment automatically
# $0.01 per scan · $0.002 per CVE lookup · $0.05 per monitor

# Discovery endpoint:
curl https://vulnfeed-api.novadyne.ai/.well-known/x402

Uses the x402 protocol — USDC on Base via Coinbase facilitator. No middleman, instant settlement. View pricing & endpoints.

Deep dive: a pay-per-call CVE & EPSS MCP server priced via x402 — how agents buy vulnerability data without an account. Free citable data: the EPSS-ranked top-CVEs JSON feed.

Common questions

Is there a paid x402 vulnerability feed API?

Yes. VulnFeed serves CVE and EPSS vulnerability data as pay-per-call x402 endpoints: $0.002 USDC per CVE lookup and $0.01 per dependency scan, settled on Base. There is no account, API key, or subscription — an x402-compatible client receives the HTTP 402 payment requirements and pays per request. Endpoints are listed at the x402 discovery endpoint.

How do I get EPSS exploit-prediction scores via an API or MCP server?

EPSS (Exploit Prediction Scoring System) scores are published by FIRST.org and updated daily. VulnFeed serves live EPSS scores alongside CVE details through its MCP server (uvx vulnfeed-mcp) and its API, and publishes a free, keyless EPSS-ranked top-CVEs JSON feed that anyone can fetch or cite — no key required.

What MCP server gives an AI agent live CVE and vulnerability data?

vulnfeed-mcp (PyPI, MIT) is an MCP server that feeds an AI agent live vulnerability data: it scans dependency lockfiles across six package ecosystems (npm, PyPI, Go, crates.io, RubyGems, Packagist), looks up individual CVEs with severity and fix versions, and ranks findings by EPSS exploit probability rather than CVSS alone. The free tier is keyless — 10 scans/day with no signup.

Do I need an account or API key to use VulnFeed?

No. The free tier (10 scans/day) needs no signup or key. Beyond that, agents can pay per call with x402 micropayments — still keyless — or you can get unlimited scans for a flat $14/mo license.

Start monitoring your dependencies.