Vulnfeed
An MCP server that scans your lockfiles (npm, PyPI, Go, Rust, Ruby, PHP) for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions. $14/mo — not per-seat.
Overview
Introduction
VulnFeed monitors your project's dependencies for security vulnerabilities — native to Claude Code.
What it does:
- Reads your lockfile (package-lock.json, requirements.txt, go.sum, Cargo.lock, Gemfile.lock, composer.lock, yarn.lock, Pipfile.lock, pnpm-lock.yaml)
- Queries NVD + GitHub Advisory Database for known CVEs
- Enriches with EPSS (Exploit Prediction Scoring System) scores to filter noise
- Recommends exact fix versions from package registries
- Monitors projects continuously — get alerts when new CVEs drop
9 tools:
scan_project— auto-detect and scan all lockfiles in a directoryscan_lockfile— scan a specific lockfilecheck_package— check a single package for vulnslookup_cve— detailed CVE info with EPSS + fix versionsmonitor_project— register for continuous monitoringcheck_alerts— new vulns since last scanupdate_deps— update snapshot after upgrading packageslist_monitored— see all monitored projectsunmonitor_project— remove from monitoring
Free tier: 10 scans/day, 1 monitored project. No signup required. Paid: $14/mo via Polar.sh. Unlimited scans + projects.
Homepage
Purchase URL
https://buy.polar.sh/polar_cl_l2u7OfEs3L3NaMKsCQByy271MbERK5JO6ePqR0mRfBj
Transport
stdio (local install), SSE (remote)
Tool count
9
Supported ecosystems
npm, PyPI, Go, crates.io, RubyGems, Packagist (9 lockfile formats)
Server Config
{
"mcpServers": {
"vulnfeed": {
"command": "uvx",
"args": [
"vulnfeed-mcp"
]
}
}
}Project Info
Created At
20 days agoUpdated At
20 days agoAuthor Name
infai-techStar
-Language
-License
-Recommend Servers
View AllFilesystem
@modelcontextprotocol
2 months ago