# vulners-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/vulnersCom/vulners-mcp  
**GitHub Stars:** 7  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/vulners-mcp

## Description
MCP server for the Vulners.com API

## Tools
Capabilities this server exposes over MCP:

- **search_lucene** — 🔍 DISCOVERY TOOL FOR UNKNOWN VULNERABILITIES 🔍 Full-text search in Vulners Knowledge Base using Lucene syntax. Use ONLY when you don't have specific IDs or version information. NEVER use for known CVE/bulletin IDs - use bulletin_by_id instead. NEVER use for specific software versions (e.g., 'Chro…
- **bulletin_by_id** — 🚨 PRIMARY TOOL FOR KNOWN IDs 🚨 Fetch a bulletin by CVE or Vulners ID. Returns a COMPACT triage-card summary by default -- id, title, CVSS3, EPSS, CVE list, and a compact exploitation/AI signal -- NOT the full record. Pass fields=[...] to widen (e.g. add 'description', 'cvss', 'cvss2', 'affectedSo…
- **query_autocomplete** — Autocomplete helper for search inputs (vendors, products, CVEs, etc.). Get search suggestions from the Vulners database.
- **search_cpe** — Find CPE strings by vendor+product (latest schema). Search for Common Platform Enumeration identifiers in the Vulners database.
- **audit_software** — 🔍 VERSION-SPECIFIC SOFTWARE AUDIT 🔍 Audit specific software versions for known vulnerabilities. Use this when you have exact software version information (e.g., Chrome 138.0.7204.184). NEVER use search_lucene for version-specific software audits.
- **audit_linux_packages** — Linux package audit (RPM/DEB) for a given distro + version. Analyze Linux package vulnerabilities against the Vulners database.
- **get_supported_os** — List supported OS identifiers/versions for Linux package audit. Get available operating systems for vulnerability analysis.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "vulners-mcp": {
    "command": "uvx",
    "args": ["vulners-mcp"],
    "env": {
      "VULNERS_API_KEY": "",
      "VULNERS_MCP_ANON_API_KEY": "",
      "MCP_TRANSPORT_MODE": "",
      "VULNERS_BASE_URL": ""
    }
  }
}
```

**Requires environment variables:** `VULNERS_API_KEY`, `VULNERS_MCP_ANON_API_KEY`, `MCP_TRANSPORT_MODE`, `VULNERS_BASE_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What vulners-mcp does

vulners-mcp exposes Vulners vulnerability data as Model Context Protocol tools for assistants and developer workflows. It can search the Vulners Knowledge Base with Lucene syntax, retrieve a bulletin by CVE or Vulners identifier, suggest search terms, locate CPE strings, and audit software or Linux packages against known vulnerabilities.

The server is intended for both exploratory research and targeted assessment. Use `search_lucene` when the vulnerability or product information is not yet specific. Use `bulletin_by_id` for a known CVE or Vulners bulletin, and use the audit tools when exact software versions or Linux distribution packages are available.

## How it works

The server calls the Vulners API and returns results through MCP. Local deployments normally use stdio, which suits desktop assistants and other local MCP clients. HTTP deployments use the `/mcp` endpoint and can run at a local address or use the hosted service at `https://mcp.vulners.com/mcp`.

The hosted and HTTP modes accept a caller’s Vulners key in the `X-Api-Key` header on each request. Deployments may also provide an anonymous HTTP tier with smaller result limits and shared rate limiting. Tool discovery works without a key, while authenticated requests receive the caller’s full limits at this server layer.

## Setup and configuration

A Vulners API key with the `api` scope is required for normal authenticated access. Create one through the Vulners website, then provide it as `VULNERS_API_KEY` for a local stdio process. The package can be run with `uvx vulners-mcp` or installed with pip, and a Docker image is available from `ghcr.io/vulnerscom/vulners-mcp`.

For HTTP mode, set `MCP_TRANSPORT_MODE` to `http`; `VULNERS_BASE_URL` can configure the Vulners service base URL. The server listens on the MCP HTTP endpoint used by the deployment. `VULNERS_MCP_ANON_API_KEY` can supply a separate key for an anonymous HTTP tier; when unset, HTTP mode can use `VULNERS_API_KEY` for that tier.

Claude Desktop can launch the Docker image or the Python package as a stdio process. Streamable HTTP clients can connect to the hosted endpoint and attach the API key as a request header.

## Tools and capabilities

- `search_lucene` performs full-text searches across the Vulners Knowledge Base using Lucene syntax. It is intended for discovering unknown vulnerabilities rather than looking up known IDs or exact versions.
- `bulletin_by_id` retrieves a CVE or Vulners bulletin. Its default response is a compact triage summary; requested fields can expand the result.
- `query_autocomplete` returns suggestions for vendors, products, CVEs, and related search inputs.
- `search_cpe` finds CPE identifiers using a vendor and product.
- `audit_software` checks specific software versions for known vulnerabilities.
- `audit_linux_packages` analyzes RPM or DEB packages for a selected distribution and version.
- `get_supported_os` lists operating-system identifiers and versions available for Linux package auditing.

## Limitations and notes

Local operation requires Python 3.13 or newer, network access to the Vulners API, and a valid API key. Docker deployments require Docker Engine. Anonymous HTTP access depends on how the deployment is configured and may be size- and rate-limited. For accurate version-specific results, provide exact software versions or package details rather than using broad text search.

_Full upstream README: https://allmcps.com/mcp/vulners-mcp/readme_