Log inSubmit server
Vulners MCP logo

Vulners MCP

Searches Vulners vulnerability data, retrieves bulletins, and audits software and Linux packages through MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Vulners MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "vulners-mcp": {
      "command": "uvx",
      "args": [
        "vulners-mcp"
      ],
      "env": {
        "VULNERS_API_KEY": "YOUR_VALUE_HERE",
        "VULNERS_MCP_ANON_API_KEY": "YOUR_VALUE_HERE",
        "MCP_TRANSPORT_MODE": "YOUR_VALUE_HERE",
        "VULNERS_BASE_URL": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx vulners-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 12d ago.

Overview

vulners-mcp connects MCP-compatible assistants to the Vulners vulnerability database through the Vulners API. Its seven tools cover Lucene discovery, known CVE or Vulners ID lookups, CPE search, autocomplete, software audits, Linux package audits, and supported OS discovery. Run it locally over stdio with a Vulners API key, or expose it over HTTP and authenticate requests with an X-Api-Key header. Reach for it when an agent needs vulnerability research or version-specific package analysis from Vulners.

Use cases

  • Search for newly relevant vulnerabilities by product or topic
  • Retrieve triage details for a known CVE or Vulners bulletin
  • Audit exact software versions against the Vulners database
  • Check Linux RPM or DEB packages for distribution-specific vulnerabilities
  • Find CPE identifiers for a vendor and product

Key features

  • Lucene full-text vulnerability search
  • CVE and Vulners bulletin lookup
  • Software version and Linux package auditing
  • CPE search and query autocomplete
  • stdio and HTTP transport support
  • Supported Linux OS discovery

Tools7

What Vulners MCP lets your agent do. Expand a tool for its parameters.

Self-reported~363 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

8/8 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 14d ago via OSV.dev · vulners-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars7Stargazers on the source repository.
Last commit16d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed7Callable tools this server registers over MCP.

How Vulners MCP works

What vulners-mcp does

vulners-mcp exposes Vulners vulnerability data as Model Context Protocol tools for assistants and developer workflows. It can search the Vulners Knowledge Base with Lucene syntax, retrieve a bulletin by CVE or Vulners identifier, suggest search terms, locate CPE strings, and audit software or Linux packages against known vulnerabilities.

The server is intended for both exploratory research and targeted assessment. Use search_lucene when the vulnerability or product information is not yet specific. Use bulletin_by_id for a known CVE or Vulners bulletin, and use the audit tools when exact software versions or Linux distribution packages are available.

How it works

The server calls the Vulners API and returns results through MCP. Local deployments normally use stdio, which suits desktop assistants and other local MCP clients. HTTP deployments use the /mcp endpoint and can run at a local address or use the hosted service at https://mcp.vulners.com/mcp.

The hosted and HTTP modes accept a caller’s Vulners key in the X-Api-Key header on each request. Deployments may also provide an anonymous HTTP tier with smaller result limits and shared rate limiting. Tool discovery works without a key, while authenticated requests receive the caller’s full limits at this server layer.

Setup and configuration

A Vulners API key with the api scope is required for normal authenticated access. Create one through the Vulners website, then provide it as VULNERS_API_KEY for a local stdio process. The package can be run with uvx vulners-mcp or installed with pip, and a Docker image is available from ghcr.io/vulnerscom/vulners-mcp.

For HTTP mode, set MCP_TRANSPORT_MODE to http; VULNERS_BASE_URL can configure the Vulners service base URL. The server listens on the MCP HTTP endpoint used by the deployment. VULNERS_MCP_ANON_API_KEY can supply a separate key for an anonymous HTTP tier; when unset, HTTP mode can use VULNERS_API_KEY for that tier.

Claude Desktop can launch the Docker image or the Python package as a stdio process. Streamable HTTP clients can connect to the hosted endpoint and attach the API key as a request header.

Tools and capabilities

  • search_lucene performs full-text searches across the Vulners Knowledge Base using Lucene syntax. It is intended for discovering unknown vulnerabilities rather than looking up known IDs or exact versions.
  • bulletin_by_id retrieves a CVE or Vulners bulletin. Its default response is a compact triage summary; requested fields can expand the result.
  • query_autocomplete returns suggestions for vendors, products, CVEs, and related search inputs.
  • search_cpe finds CPE identifiers using a vendor and product.
  • audit_software checks specific software versions for known vulnerabilities.
  • audit_linux_packages analyzes RPM or DEB packages for a selected distribution and version.
  • get_supported_os lists operating-system identifiers and versions available for Linux package auditing.

Limitations and notes

Local operation requires Python 3.13 or newer, network access to the Vulners API, and a valid API key. Docker deployments require Docker Engine. Anonymous HTTP access depends on how the deployment is configured and may be size- and rate-limited. For accurate version-specific results, provide exact software versions or package details rather than using broad text search.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Vulners MCP

vulners-mcp is an MCP server that connects AI assistants to the Vulners vulnerability database through the Vulners API. Its tools search bulletins, retrieve known CVE or Vulners IDs, find CPEs, autocomplete queries, audit software versions and Linux packages, and list supported operating systems.

Install it with `uvx vulners-mcp` or pip, or run the published Docker image. Set `VULNERS_API_KEY` for a local stdio process, then add the command to your MCP client configuration. Docker can also run the server in HTTP mode.

Connect to `https://mcp.vulners.com/mcp` or to your own HTTP deployment and send `X-Api-Key` with each request. The server supports Streamable HTTP, and tool discovery can work without a key when the deployment permits it.

Use `bulletin_by_id` for a known CVE or Vulners bulletin identifier. It returns a compact triage-focused result by default, and you can request additional fields when a wider record is needed.

Use `audit_linux_packages` with the Linux distribution, version, and RPM or DEB package details. Call `get_supported_os` first when you need the available operating-system identifiers for the audit.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewVulners MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/vulners-mcp?style=directory)](https://allmcps.com/mcp/vulners-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/vulners-mcp"><img src="https://allmcps.com/api/badge/vulners-mcp?style=directory" alt="Vulners MCP on AllMCPs" /></a>