mcpField
V
VulnCheck

VulnCheck

Local
github.com/vulncheck-ossSecurity13Updated 2w ago
Repository

About VulnCheck

VulnCheck MCP Server connects AI assistants to VulnCheck vulnerability intelligence for security research and triage. It covers CVEs, package exposure, exploit activity, advisories, and threat indices.

Key features

  1. 01CVE and severity lookup
  2. 02CPE and PURL package checks
  3. 03Exploit and active-threat intelligence
  4. 04Vendor and ecosystem advisory search
  5. 05Breach, botnet, and threat index queries

Use cases

  1. 01Research a CVE while triaging an issue
  2. 02Check dependencies before release
  3. 03Assess known exploit activity and C2 indicators
  4. 04Find advisories for a product or package

MCP support

Exposes VulnCheck vulnerability intelligence to MCP clients through tools for CVE, package, exploit, advisory, and index queries. Requires a VulnCheck API token.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "vulncheck-oss": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/vulncheck-oss/mcp:0.2.3"
      ]
    }
  }
}
Run commanddocker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/vulncheck-oss/mcp:0.2.3

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

VulnCheck Logo

The VulnCheck MCP Server

The VulnCheck MCP Server connects AI assistants to VulnCheck vulnerability intelligence. Ask your AI tools about CVEs, exploits, advisories, and vulnerable packages — directly in your editor or terminal, using natural language.

Use Cases
  • CVE research: Look up vulnerability details, severity, exploitability, and affected versions while reviewing code or triaging issues
  • Dependency analysis: Check packages by CPE or PURL to identify known vulnerabilities before shipping
  • Exploit intelligence: Determine whether a CVE has known exploit code, active exploitation, or C2 indicators
  • Advisory lookup: Search vendor and ecosystem advisories by package, product, or keyword
  • Index queries: Query VulnCheck's breach, botnet, and threat intelligence indices for real-time context

Requirements

  • A VulnCheck API token — create one here

Installation

Download the latest release from the Releases page, or use the Docker image (ghcr.io/vulncheck-oss/mcp).

PlatformArchive
macOS (Apple Silicon)vulncheck-mcp_1.2.3_darwin_arm64.tar.gz
macOS (Intel)vulncheck-mcp_1.2.3_darwin_amd64.tar.gz
Linuxvulncheck-mcp_1.2.3_linux_amd64.tar.gz
Windowsvulncheck-mcp_1.2.3_windows_amd64.zip
Install in Your AI Client

Available Tools

See docs/tools.md for the full list of available tools.

Development

make build      # build for current platform → bin/vulncheck-mcp
make snapshot   # cross-compile all platforms via GoReleaser → dist/
make test       # run tests
make lint       # run golangci-lint

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.