Know when your dependencies are vulnerable.
An MCP server that reads your lockfile, checks NVD + GitHub Advisories, and tells you what actually matters — prioritized by real-world exploit probability, with exact fix versions.
Free tier — 10 scans/day, no signup. $14/mo for unlimited.
Building an agent instead of shipping code yourself? VulnFeed is also a keyless, pay-per-call CVE & EPSS feed over x402 — your agent hits a 402, pays a few cents in USDC, and gets structured, exploit-ranked results. No account, no API key, no subscription. Agent API →
Why not just ask Claude to check?
It knows your deps
Reads your package-lock.json, requirements.txt, or go.sum and filters to only the CVEs that hit your actual dependency tree. No noise from packages you don't use.
EPSS prioritization
Most CVEs are noise. EPSS (Exploit Prediction Scoring System) scores each one by real-world exploitability. VulnFeed surfaces the ones likely to be used in real attacks.
Fix recommendations
Not just "you're vulnerable" but upgrade express 4.17.1 → 4.21.0. Cross-references npm, PyPI, and Go registries for the exact version that fixes the issue.
Continuous monitoring
Register your project once. Check back any time for new vulnerabilities. New CVE published at 3am? It's in the index by 3:15am for your morning session.
9 tools, one install
Scan a lockfile, check a package, look up a CVE, monitor a project, check alerts, update deps, list projects. Everything a security workflow needs.
Zero upstream cost
Data sources are NVD, GitHub Advisory DB, and EPSS — all free, public APIs. No vendor lock-in, no data broker middlemen. Your $14 pays for the intelligence layer, not data access.
How it compares
| Free MCP servers | Snyk / Socket | VulnFeed | |
|---|---|---|---|
| CVE lookup | ✓ | ✓ | ✓ |
| Knows your deps | — | ✓ | ✓ |
| EPSS prioritization | — | ✓ | ✓ |
| Fix recommendations | — | ✓ | ✓ |
| Continuous monitoring | — | ✓ | ✓ |
| MCP-native | ✓ | — | ✓ |
| Free tier | ✓ | — | ✓ (10 scans/day) |
| x402 micropayments | — | — | ✓ ($0.01/scan) |
| Price (paid) | Free | $25-49/dev/mo | $14/mo flat |
Setup in 2 minutes
Free tier — no signup, no API key
10 scans/day, 1 monitored project. Just add this to your MCP config:
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": ["vulnfeed-mcp"]
}
}
}
Works in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf.
Restart your client. Ask it to scan my project for vulnerabilities. That's it.
Unlimited — $14/mo
Unlimited scans, unlimited monitored projects. Add your license key:
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": ["vulnfeed-mcp"],
"env": {
"VULNFEED_API_KEY": "YOUR_LICENSE_KEY_HERE"
}
}
}
}
Get your license key — flat rate, not per-seat, not per-repo.
Pay-per-scan — x402 micropayments
AI agents can pay per request with USDC on Base — no account, no API key, no subscription. Your agent gets a 402 response, pays $0.01, and gets results. Works with any x402-compatible client.
# Agent sends request, gets HTTP 402 with payment details # x402 client library handles payment automatically # $0.01 per scan · $0.002 per CVE lookup · $0.05 per monitor # Discovery endpoint: curl https://vulnfeed-api.novadyne.ai/.well-known/x402
Uses the x402 protocol — USDC on Base via Coinbase facilitator. No middleman, instant settlement. View pricing & endpoints.
Deep dive: a pay-per-call CVE & EPSS MCP server priced via x402 — how agents buy vulnerability data without an account. Free citable data: the EPSS-ranked top-CVEs JSON feed.
Common questions
Is there a paid x402 vulnerability feed API?
Yes. VulnFeed serves CVE and EPSS vulnerability data as pay-per-call x402 endpoints: $0.002 USDC per CVE lookup and $0.01 per dependency scan, settled on Base. There is no account, API key, or subscription — an x402-compatible client receives the HTTP 402 payment requirements and pays per request. Endpoints are listed at the x402 discovery endpoint.
How do I get EPSS exploit-prediction scores via an API or MCP server?
EPSS (Exploit Prediction Scoring System) scores are published by FIRST.org and updated daily. VulnFeed serves live EPSS scores alongside CVE details through its MCP server (uvx vulnfeed-mcp) and its API, and publishes a free, keyless EPSS-ranked top-CVEs JSON feed that anyone can fetch or cite — no key required.
What MCP server gives an AI agent live CVE and vulnerability data?
vulnfeed-mcp (PyPI, MIT) is an MCP server that feeds an AI agent live vulnerability data: it scans dependency lockfiles across six package ecosystems (npm, PyPI, Go, crates.io, RubyGems, Packagist), looks up individual CVEs with severity and fix versions, and ranks findings by EPSS exploit probability rather than CVSS alone. The free tier is keyless — 10 scans/day with no signup.
Do I need an account or API key to use VulnFeed?
No. The free tier (10 scans/day) needs no signup or key. Beyond that, agents can pay per call with x402 micropayments — still keyless — or you can get unlimited scans for a flat $14/mo license.