securityvulnerability-scanningdependenciesdevsecops
Scans dependency lockfiles for vulnerabilities, adds EPSS exploit scores, and recommends fix versions.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Overview
Use cases
Scan project lockfiles for known vulnerabilities
Prioritize CVEs by exploit probability
Check individual packages or CVEs
Monitor dependency snapshots for new alerts
Find recommended package fix versions
Key features
Auto-detects and scans supported lockfiles
Scans npm, Yarn, pnpm, pip, Pipenv, Go, Rust, Ruby, and PHP dependencies
Enriches vulnerability results with EPSS scores
Suppresses low-priority findings by default
Recommends fix versions from package registries
Supports baseline monitoring and alert checks
Capabilities & Tool Schemas (9)
Inspect callable tools, capabilities, and parameters exposed to AI agents by Vulnfeed MCP.
scan_projectAuto-detect and scan all lockfiles in a directory
scan_lockfileScan a specific lockfile
check_packageCheck a single package for vulnerabilities
lookup_cveDetailed CVE info with EPSS + fix versions
monitor_projectRegister for continuous monitoring
check_alertsNew vulns since last scan
Documentation Overview
VulnFeed — Dependency Vulnerability Monitoring for Claude Code
An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.
Free tier — 10 scans/day, 1 monitored project, no signup required.
Homepage: vulnfeed.novadyne.ai
Install
MCP client config
Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):
Free tier (no signup, no API key):
Paid ($14/mo, unlimited scans + projects):
Get a license key at vulnfeed.novadyne.ai.
x402 micropayments
VulnFeed also accepts x402 micropayments — AI agents can pay per scan with USDC on Base, no API key or signup needed. When the free tier limit is reached, the API returns HTTP 402 with payment requirements that x402-compatible clients handle automatically.
- $0.01 per scan
- $0.002 per CVE lookup
- $0.05 per project monitor setup
Tools
Scanning
| Tool | Description |
|---|---|
scan_project | Auto-detect and scan all lockfiles in a directory |
scan_lockfile | Scan a specific lockfile |
check_package | Check a single package for vulnerabilities |
lookup_cve | Detailed CVE info with EPSS + fix versions |
Monitoring
| Tool | Description |
|---|---|
monitor_project | Register for continuous monitoring |
check_alerts | New vulns since last scan |
update_deps | Update snapshot after upgrading packages |
list_monitored | See all monitored projects |
unmonitor_project | Remove from monitoring |
Supported lockfiles
package-lock.json(npm)yarn.lock(Yarn)pnpm-lock.yaml(pnpm)requirements.txt(pip)Pipfile.lock(Pipenv)go.sum/go.mod(Go)Cargo.lock(Rust)Gemfile.lock(Ruby)composer.lock(PHP)
How it works
- Parses your lockfile to extract dependency names + versions
- Queries OSV.dev (NVD + GitHub Advisories) for known CVEs
- Enriches with EPSS exploit probability scores
- Filters noise — suppresses low-EPSS, non-critical CVEs by default
- Sorts by exploitability — most likely to be exploited first
- Returns fix version recommendations from package registries
Smart filtering
By default, VulnFeed suppresses low-priority CVEs (EPSS < 10% AND CVSS < 9.0). This cuts noise by ~80%.
Pass show_all=True to any scan tool to see everything.
Continuous monitoring
monitor_project— takes a baseline snapshot of current deps + known vulnscheck_alerts— diffs against baseline, surfaces only new vulns- Run
check_alertsperiodically to catch newly published CVEs
License
MIT
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks — not a rating.
GitHub stars
1
Stargazers on the source repository.
Last commit
1mo ago
Most recent push to the default branch.
Tools exposed
9
Callable tools this server registers over MCP.
Directory activity
2 views
Config copies, upvotes, and views on AllMCPs.
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Vulnfeed MCP
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/infai-tech-vulnfeed-mcp)HTML Embed
<a href="https://allmcps.com/mcp/infai-tech-vulnfeed-mcp"><img src="https://allmcps.com/api/badge/infai-tech-vulnfeed-mcp?style=directory" alt="Vulnfeed MCP on AllMCPs" /></a>Technical Specs & Signals
CategorySecurity
PricingFreemium
56Quality signal: Good · 56/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools29/30
Adoption & activity3/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Supply-chain signal
No high-severity advisories surfaced by our automated scan.
Critical 0High 0Medium 0Low 0
Scanned 22d ago via OSV.dev · vulnfeed-mcp (PyPI)
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.