Vulnerability Intelligence MCP Server
Pricing
from $3.00 / 1,000 read operations
Vulnerability Intelligence MCP Server
Vulnerability intelligence MCP server for Claude, ChatGPT, Cursor and other AI agents. Scan up to 100 pinned dependencies for known vulnerabilities and fixed versions, read CVE records from the NVD with CVSS, CWE and known-exploited dates, and follow the newest CVEs. Read-only.
Pricing
from $3.00 / 1,000 read operations
Rating
0.0
(0)
Developer
MrBridge
Maintained by CommunityActor stats
0
Bookmarked
1
Total users
0
Monthly active users
7 days ago
Last modified
Categories
Security
Limited permissionsShare
🛡️ Vulnerability Intelligence MCP Server
Vulnerability Intelligence MCP Server is an MCP server that gives Claude, ChatGPT, Cursor, VS Code and other AI agents two public vulnerability databases in one place: OSV.dev for package advisories and fixed versions, and the National Vulnerability Database (NVD) for CVE records with CVSS scores, CWE weaknesses and CISA Known Exploited Vulnerabilities (KEV) dates. Its 10 read-only tools scan dependencies, read advisories and CVEs, and list the newest CVEs and KEV additions.
Paste a lockfile and ask Claude "which of these dependencies have known vulnerabilities, and what should I upgrade to?". It calls vuln_check_dependencies on up to 100 pinned packages and returns the severity and the fixed versions for each one. Then ask "is CVE-2021-44228 on the KEV list, and what changed on it since publication?" to get the dates, the required action and the change history.
This product uses the NVD API but is not endorsed or certified by the NVD.
Quick start
- Copy your API token from Apify Console > Settings > API & Integrations.
- Add
https://mrbridge--vuln-intel-mcp.apify.actor/mcpto your AI client with the headerAuthorization: Bearer <token>. The Connect section below has a ready-made snippet for each client. - Ask a question such as "list the critical CVEs published in the last two days".
What this server exposes
This server gives an AI client 10 read-only tools over two public vulnerability databases. From OSV.dev, which gathers the GitHub Advisory Database, the PyPI, Go and RustSec databases and many Linux distributions, it checks one package version, or a list of up to 100 pinned dependencies, for known vulnerabilities and the versions that fix them, and reads any advisory by its id. From the National Vulnerability Database (NVD) run by NIST, it reads CVE records with their CVSS scores, CWE weaknesses and CISA Known Exploited Vulnerabilities (KEV) dates, searches CVEs by keyword or weakness, lists the latest CVEs and the latest KEV additions, finds the CPE name of a product and lists its CVEs, and shows how a CVE changed over time. You need no account or API key with either source, and every answer names its sources and their licences. The tools only read public data: they scan no system and return no exploit code.
This product uses the NVD API but is not endorsed or certified by the NVD. This server is not affiliated with or endorsed by NIST, the NVD, Google, the OpenSSF or the databases that OSV.dev aggregates.
Tools
| Tool | What it answers | Billed event |
|---|---|---|
vuln_check_package | Check a package version for known vulnerabilities | tool-read |
vuln_check_dependencies | Check a list of dependencies for known vulnerabilities | tool-action |
vuln_get_advisory | Get an open source vulnerability advisory by id | tool-read |
vuln_get_cve | Get CVE details from the NVD | tool-read |
vuln_search_cves | Search CVEs in the NVD by keyword or weakness | tool-read |
vuln_list_recent_cves | List CVEs published in the last days | tool-read |
vuln_list_exploited_cves | List CVEs recently added to the CISA KEV catalogue | tool-read |
vuln_list_product_cves | List CVEs affecting a product (CPE) | tool-read |
vuln_search_products | Find the CPE name of a product in the NVD dictionary | tool-read |
vuln_get_cve_history | Get the change history of a CVE in the NVD | tool-read |
vuln_check_package: Check a package version for known vulnerabilities
Use this when you need to know whether one open source package, at one version, is affected by known vulnerabilities, and which versions fix them, from OSV.dev (GitHub, PyPI, Go, RustSec and other advisory databases). Do not use for several packages at once (use vuln_check_dependencies), for one advisory id (use vuln_get_advisory), or for CVSS scores and CISA KEV status of a CVE (use vuln_get_cve). Parameters: ecosystem (e.g. "npm", "PyPI", "Debian:12") and package_name (e.g. "lodash"), or purl (e.g. "pkg:npm/lodash@4.17.20"), version (optional, e.g. "4.17.20", without it every recorded vulnerability of the package is listed and vulnerable is null), limit (1-50, default 20, max 10 when detailed), offset (default 0), response_format ("concise" default, "detailed" adds shortened details, affected ranges and references). Newest advisories first.
| Parameter | Type | Required | Example |
|---|---|---|---|
ecosystem | string | no | "npm" |
package_name | string | no | "lodash" |
version | string | no | "4.17.20" |
purl | string | no | "pkg:npm/lodash@4.17.20" |
limit | integer | no | 20 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { package, vulnerable, vulnerability_count, total_is_lower_bound, vulnerabilities[], notes[], pagination, attribution }. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.
vuln_check_dependencies: Check a list of dependencies for known vulnerabilities
Use this when you need to scan a list of pinned dependencies (a lockfile, an SBOM, a requirements list) for known vulnerabilities in one call, from OSV.dev, with severity and fixed versions for each package. Do not use for one package (use vuln_check_package), for version-less package names, or for NVD scores and KEV status (use vuln_get_cve with the CVE aliases). Parameters: packages (array of 1 to 100 items, each ecosystem + package_name + version, e.g. {"ecosystem":"npm","package_name":"lodash","version":"4.17.20"}, or a versioned purl, e.g. {"purl":"pkg:pypi/jinja2@2.4.1"}), limit (packages per page, 1-100, default 50), offset (default 0), response_format ("concise" default, "detailed" adds shortened advisory details and references). Advisories of each page are loaded for at most 30 ids.
| Parameter | Type | Required | Example |
|---|---|---|---|
packages | array of object | yes | [{"ecosystem":"npm","package_name":"lodash","version":"4.17.20"},{"purl":"pkg:pypi/jinja2@2.4.1"}] |
limit | integer | no | 50 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { summary, packages[], advisories[], notes[], pagination, attribution }. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.
vuln_get_advisory: Get an open source vulnerability advisory by id
Use this when you have an advisory id (GHSA, PYSEC, GO, RUSTSEC, OSV, MAL, CVE and other OSV.dev ids) and need its summary, aliases, affected packages with introduced and fixed versions, and references. Do not use for NVD CVSS scores, CWE or CISA KEV status (use vuln_get_cve), or to find advisories of a package (use vuln_check_package). Parameters: id (string, case-insensitive, e.g. "GHSA-jfh8-c2jp-5v3q", "PYSEC-2021-19", "RUSTSEC-2021-0001", "CVE-2021-44228"), response_format ("concise" default: 800 characters of details, 30 packages, 10 references, "detailed": 4,000 characters, 100 packages, 50 references). The answer suggests a vuln_get_cve call for CVE aliases.
| Parameter | Type | Required | Example |
|---|---|---|---|
id | string | yes | "GHSA-jfh8-c2jp-5v3q" |
response_format | "concise" or "detailed" | no | "concise" |
Returns { advisory, affected_packages[], affected_packages_total, cve_ids[], next_calls[], notes[], attribution }. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.
vuln_get_cve: Get CVE details from the NVD
Use this when you need the NVD record of one or more CVEs: description, CVSS scores and vectors, CWE ids, CISA Known Exploited Vulnerabilities (KEV) dates and required action, vulnerable CPE configurations and references. Do not use for open source package advisories and fixed package versions (use vuln_get_advisory or vuln_check_package), or to find CVEs by keyword (use vuln_search_cves). Parameters: cve_ids (array of 1 to 10 CVE ids, case-insensitive, e.g. ["CVE-2021-44228"], asked in one NVD request), response_format ("concise" default, "detailed" for at most 2 ids adds every metric with vectors, SSVC, vendor comments, 50 references and 100 CPE criteria). Descriptions are verbatim NVD text.
| Parameter | Type | Required | Example |
|---|---|---|---|
cve_ids | array of string | yes | ["CVE-2021-44228"] |
response_format | "concise" or "detailed" | no | "concise" |
Returns { cves[], not_found[], notes[], attribution }. Upstream: NVD. Cache: daily (1 day). Read-only.
vuln_search_cves: Search CVEs in the NVD by keyword or weakness
Use this when you need to find CVEs by keyword in their description (product, vendor, technology) or by CWE weakness, optionally filtered by CVSS severity, publication dates and CISA KEV listing, newest first, from the NVD. Do not use for the latest CVEs without a keyword (use vuln_list_recent_cves), for CVEs of one exact product version (use vuln_list_product_cves), or for open source packages (use vuln_check_package). Parameters: keyword (e.g. "FortiOS") and or cwe_id (e.g. "CWE-79"), at least one, exact_phrase (default false), severity ("LOW", "MEDIUM", "HIGH", "CRITICAL"), cvss_version ("v3" default or "v4"), published_from and published_to ("YYYY-MM-DD", at most 120 days apart), known_exploited_only (default false), limit (1-20, default 10), offset (default 0), response_format ("concise" default, "detailed" adds CWE, KEV dates and tags).
| Parameter | Type | Required | Example |
|---|---|---|---|
keyword | string | no | "FortiOS" |
exact_phrase | boolean | no | false |
cwe_id | string | no | "CWE-79" |
severity | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | "CRITICAL" |
cvss_version | "v3" or "v4" | no | "v3" |
published_from | string | no | "2026-06-01" |
published_to | string | no | "2026-09-27" |
known_exploited_only | boolean | no | false |
limit | integer | no | 10 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { query, cves[], notes[], pagination, attribution }. Upstream: NVD. Cache: daily (1 day). Read-only.
vuln_list_recent_cves: List CVEs published in the last days
Use this when you need the CVEs the NVD published over the last days, newest first, optionally only critical or high ones, or only those in the CISA KEV catalogue, for a vulnerability watch or a daily briefing. Do not use for a keyword or product search (use vuln_search_cves or vuln_list_product_cves), or for recent additions to the KEV catalogue whatever the CVE date (use vuln_list_exploited_cves). Parameters: days (1-30, default 7, the window ends at the start of the current UTC hour), severity ("LOW", "MEDIUM", "HIGH", "CRITICAL"), cvss_version ("v3" default or "v4"), known_exploited_only (default false), limit (1-20, default 10), offset (default 0), response_format ("concise" default, "detailed" adds CWE, KEV dates and tags).
| Parameter | Type | Required | Example |
|---|---|---|---|
days | integer | no | 3 |
severity | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | "CRITICAL" |
cvss_version | "v3" or "v4" | no | "v3" |
known_exploited_only | boolean | no | false |
limit | integer | no | 10 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { query, cves[], notes[], pagination, attribution }. Upstream: NVD. Cache: hourly (1 hour). Read-only.
vuln_list_exploited_cves: List CVEs recently added to the CISA KEV catalogue
Use this when you need the vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalogue over the last days, newest addition first, with the due date and the CISA vulnerability name, as recorded by the NVD. Do not use for CVEs published recently whatever their exploitation (use vuln_list_recent_cves), or to check one CVE (use vuln_get_cve, its kev block). Parameters: days (1-120, default 30, the window ends at the start of the current UTC hour), limit (1-20, default 10), offset (default 0), response_format ("concise" default, "detailed" adds the CISA required action, CWE and tags).
| Parameter | Type | Required | Example |
|---|---|---|---|
days | integer | no | 30 |
limit | integer | no | 10 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { query, cves[], notes[], pagination, attribution }. Upstream: NVD. Cache: hourly (1 hour). Read-only.
vuln_list_product_cves: List CVEs affecting a product (CPE)
Use this when you need the CVEs the NVD maps to one product, by its CPE 2.3 name: one version ("cpe:2.3:a:apache:http_server:2.4.49") or every version ("cpe:2.3:a:apache:http_server"), newest first. Do not use for finding the CPE name of a product (use vuln_search_products first), for open source packages by ecosystem (use vuln_check_package), or for a free-text search (use vuln_search_cves). Parameters: cpe (CPE 2.3 name, e.g. "cpe:2.3:a:apache:http_server:2.4.49"), vulnerable_only (default true, versioned CPE only), severity ("LOW", "MEDIUM", "HIGH", "CRITICAL"), cvss_version ("v3" default or "v4"), limit (1-20, default 10), offset (default 0), response_format ("concise" default, "detailed" adds CWE, KEV dates and tags).
| Parameter | Type | Required | Example |
|---|---|---|---|
cpe | string | yes | "cpe:2.3:a:apache:http_server:2.4.49" |
vulnerable_only | boolean | no | true |
severity | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | "CRITICAL" |
cvss_version | "v3" or "v4" | no | "v3" |
limit | integer | no | 10 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { query, cves[], notes[], pagination, attribution }. Upstream: NVD. Cache: daily (1 day). Read-only.
vuln_search_products: Find the CPE name of a product in the NVD dictionary
Use this when you need the official CPE 2.3 name of a product and version (software, operating system or hardware) from the NVD CPE dictionary, to list its CVEs with vuln_list_product_cves. Do not use for vulnerabilities themselves (use vuln_list_product_cves or vuln_search_cves), or for open source packages identified by ecosystem (use vuln_check_package). Parameters: keyword (e.g. "apache http server 2.4.49", every word must appear in the title) or cpe_match (a CPE prefix, e.g. "cpe:2.3:a:apache:http_server"), one of the two, limit (1-50, default 20), offset (default 0), response_format ("concise" default, "detailed" adds the CPE id, creation date and references). Each product carries its next_call.
| Parameter | Type | Required | Example |
|---|---|---|---|
keyword | string | no | "apache http server 2.4.49" |
cpe_match | string | no | "cpe:2.3:a:apache:http_server" |
limit | integer | no | 20 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { products[], notes[], pagination, attribution }. Upstream: NVD. Cache: daily (1 day). Read-only.
vuln_get_cve_history: Get the change history of a CVE in the NVD
Use this when you need what changed on one CVE in the NVD and when: initial analysis, CVSS rescoring, CWE or CPE changes, reference tags, CISA KEV updates, rejection, newest event first. Do not use for the current state of the CVE (use vuln_get_cve) or for the history of open source advisories (use vuln_get_advisory, its modified date). Parameters: cve_id (string, case-insensitive, e.g. "CVE-2024-3094"), limit (1-50, default 20), offset (default 0), response_format ("concise" default: event, date, source and the type of each change, "detailed": old and new values verbatim).
| Parameter | Type | Required | Example |
|---|---|---|---|
cve_id | string | yes | "CVE-2021-44228" |
limit | integer | no | 20 |
offset | integer | no | 0 |
response_format | "concise" or "detailed" | no | "concise" |
Returns { cve_id, url, events[], notes[], pagination, attribution }. Upstream: NVD. Cache: daily (1 day). Read-only.
Connect
Endpoint (Streamable HTTP): https://mrbridge--vuln-intel-mcp.apify.actor/mcp
Every client authenticates with your Apify API token, found in Apify Console > Settings > API & Integrations. Clients that support custom headers send it as Authorization: Bearer <token>. The others use the ?token= URL variant, which must be treated as a secret: keep it out of commits, screenshots and shared logs.
Claude Code
$claude mcp add --transport http vuln-intel "https://mrbridge--vuln-intel-mcp.apify.actor/mcp" --header "Authorization: Bearer ${APIFY_TOKEN}"
Cursor, VS Code and other JSON configurations
{"mcpServers": {"vuln-intel": {"type": "http","url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp","headers": {"Authorization": "Bearer ${APIFY_TOKEN}"}}}}
claude.ai and Claude Desktop
Add a custom connector with the URL https://mrbridge--vuln-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN and no authentication. Prefilled link (replace the token placeholder before saving): add Vulnerability Intelligence MCP Server to Claude.
ChatGPT (developer mode)
Settings > Apps > Create, URL https://mrbridge--vuln-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN, authentication "No authentication". ChatGPT snapshots the tool list: after a server update, an admin has to click Refresh on the app.
OpenAI Responses API
{"type": "mcp","server_label": "vuln_intel","server_url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp","headers": {"Authorization": "Bearer YOUR_APIFY_TOKEN"},"require_approval": "never"}
Add allowed_tools to restrict the tool list. Tool calls must finish within about 60 seconds on this API, and every tool of this server answers in under 50 seconds.
Anthropic Messages API
{"mcp_servers": [{"type": "url","url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp","name": "vuln-intel","authorization_token": "YOUR_APIFY_TOKEN"}],"tools": [{"type": "mcp_toolset","mcp_server_name": "vuln-intel"}]}
Send the beta header anthropic-beta: mcp-client-2025-11-20.
One-click OAuth alternative
https://mcp.apify.com/?tools=mrbridge/vuln-intel-mcp connects through Apify OAuth without a token. It exposes the Actor as a single tool rather than the granular tools listed above.
Cost control
Each Standby run has a spending limit (maxTotalChargeUsd). When a call uses the last of it, the result is still returned, and later calls in that run answer CHARGE_LIMIT_REACHED until the limit is raised.
Why use Vulnerability Intelligence MCP Server
- Two databases, one server. Package-level advisories with fixed versions from OSV.dev, and CVE-level CVSS, CWE and KEV dates from the NVD.
- Whole dependency lists. Up to 100 pinned packages per call from a lockfile, a requirements file or an SBOM, with severity and fixed versions per package.
- Newest first. Latest CVEs, latest KEV additions, keyword searches and the CVEs of a product, sorted newest first, which the NVD API does not do on its own.
- Licence-aware answers. Every record names its home database and licence, so you know how you may reuse it.
- Read-only by design. No scanning of hosts and no exploit code. The tools read public data only.
Pricing (Pay-per-Event)
Vulnerability Intelligence MCP Server uses pay-per-event pricing. Each successful call is one tool-read event at $0.005, or one tool-action event at $0.01 for a dependency scan with vuln_check_dependencies, so 1,000 reads cost $5 in events, and a scan of 100 dependencies is a single tool-action event. These are the FREE plan prices, and Apify plan discounts lower them. Apify also bills its standard apify-actor-start event when a Standby run starts, and you pay the platform usage of your own Standby run on top of the events, as explained below. Calls that end in an error carry no event charge. See the Pricing tab for the price on your Apify plan.
| Event | Charged when | Price |
|---|---|---|
apify-actor-start | run start (platform default) | see the Store page |
tool-read (primary event) | each successful read tool call | see the Store page |
tool-action | each successful call of a detailed or computed tool | see the Store page |
Never charged: initialize, tools/list, pings, readiness probes, and any call that ends in an error (invalid input, not found, upstream failure, timeout, spending limit).
Platform usage comes on top of these events. This server runs in Apify Standby mode, and you also pay the platform usage of your own Standby run, billed to your Apify account like any other run: the memory set for the Standby run, for as long as the server is up, idle time included, until the run stops at its idle timeout. The Apify pay-per-event documentation says so: "For runs in Standby mode, users always pay the platform usage costs in addition to the event charges."
Limits, caveats and attribution
- Attribution. Every answer carries an
attributionblock: the provider, the source, the terms URL and the notices below. For OSV.dev it also lists the home database and licence of the records returned. Keep it when you reuse the data. - NVD notice and CVE licence. Every NVD answer carries the notice above. Every answer with CVE content also reproduces MITRE's copyright designation and the licence of the CVE Terms of Use. NVD descriptions, scores, vectors and references come through unchanged: a long answer returns fewer rows, never shorter texts.
headline_severityis picked by this server among the scores the NVD publishes (CVSS 3.1 first, and the NVD or the CNA of the record before other sources). - NVD rate limit. Without a key, the NVD allows 5 requests in a rolling 30 seconds per IP address. This server keeps to half of that, queues requests in order, caches answers (one day, or one hour for the recent and KEV lists) and never retries an NVD request. When the queue would outlast the time budget of a call, the call answers
UPSTREAM_RATE_LIMITEDwith the wait in its hint. Other Apify users on the same outgoing IP address share that keyless quota. With an owner key the limit rises to 50 requests per 30 seconds. - NVD coverage. Since April 2026 the NVD enriches prioritised CVEs first (KEV, software used by the US federal government, critical software). Many recent CVEs carry only the score of the CNA that published them, or no score at all, so a severity filter can hide them. The recent list ends at the start of the current hour (UTC).
- OSV.dev licences. Each record keeps the licence of its home database: CC BY 4.0 for GitHub, PyPI, Go and OSS-Fuzz, CC0 for RustSec, CC BY-SA 4.0 for Ubuntu, and others. OSV.dev does not document the licence of some databases (Debian, Red Hat, SUSE, Alpine and Chainguard among them), so their records come as identifiers, dates, package names, fixed versions and a link only. Records are reshaped, and long texts end with the marker
[shortened by vuln-intel-mcp]. - OSV.dev results. A package check returns the first page that OSV.dev sends (about 1,000 advisories) and sets
total_is_lower_boundwhen more exist. A clean answer means that OSV.dev knows no vulnerability for that package and version: OSV.dev cannot tell it apart from a misspelled package name or a wrong ecosystem. Answers are cached for one hour. - Not included. Breach and password checks (Have I Been Pwned) are not part of this server.
Data terms
By using this server you agree to use the data it returns in line with the terms of each source, and to pass the same obligations on to anyone you share the data with.
- NVD: NVD API Terms of Use. Show "This product uses the NVD API but is not endorsed or certified by the NVD." where you display the data, do not use the NVD name to suggest endorsement, and do not present modified content as coming from the NVD.
- CVE records: CVE Terms of Use. Keep MITRE's copyright designation and the CVE licence with any copy.
- OSV.dev records: the licence of each home database, listed in
attribution.sourcesand on the OSV.dev data sources page. Credit the database, keep its licence, say when you change a record, and share adapted Ubuntu material under CC BY-SA 4.0.
The fee for this server pays for the service (hosting, caching, normalisation), not for a licence on the data.
Use cases
- Dependency triage. Paste a lockfile into the chat and get the vulnerable packages with the version that fixes each one.
- SBOM review. Check the pinned components of a software bill of materials before a release or a customer audit.
- Daily vulnerability briefing. "Critical CVEs published in the last two days" and "what did CISA add to the KEV catalogue this week?"
- Incident research. Open a CVE with its CVSS vectors, CWE, affected configurations, references and change history.
- Asset exposure. Find the CPE name of a product, then list the CVEs that affect one version of it.
- Security writing. Quote exact CVE details and advisory texts in reports and newsletters, credited under their licences.
The answers are informational. A clean result means that the databases know no vulnerability for that package and version, not that the software is safe.
More developer and security tools
- open source dependency check MCP: advisories, typosquatting look-alikes and licences for JavaScript, Python and Rust dependencies.
- developer Q&A search for AI: Stack Overflow questions similar to your error, with accepted and top answers.
- domain WHOIS and RDAP lookup MCP: a domain's registrar, age, expiry date and name servers over RDAP, for over 500 TLDs.
FAQ
Why is the first call slower?
The server runs in Apify Standby mode. When no request comes in for a while, the run stops at its idle timeout, and the next call starts a new one. That cold start took about 5 seconds in the last platform test. Calls made while the server is warm skip the delay.
Why can NVD calls be slow or fail?
The NVD accepts a small number of requests per 30 seconds. This server queues NVD requests, keeps to half of the limit and caches answers for one hour to one day. When the queue would outlast the time budget of a call, the call answers UPSTREAM_RATE_LIMITED with the wait in its hint. The NVD itself is sometimes down or slow, and the call then answers UPSTREAM_UNAVAILABLE or TIMEOUT. None of these calls carries an event charge, and a retry a little later usually works.
Why do some recent CVEs have no CVSS score?
Since April 2026 the NVD enriches prioritised CVEs first. Many recent CVEs carry only the score of the organisation that published them, or no score yet, so a severity filter can leave them out.
Which package managers does the dependency scan cover?
All the sources OSV.dev indexes, including npm, PyPI, Go, crates.io and Maven, plus many Linux distributions. For some distributions OSV.dev documents no licence, so their records come as identifiers, versions and a link only.
Does it check passwords or data breaches?
No. Breach and password checks are not part of this server.
Where do I check licences and typosquats?
The companion Open Source Dependency Check MCP Server covers licence reviews of whole dependency trees, look-alike package names and end-of-life dates.
Your feedback
Found a bug or a wrong answer? Open an issue on the Issues tab. Vulnerability Intelligence MCP Server is built by MrBridge. More servers are listed in the MCP server catalogue, and more tools and data studies are at mr-bridge.com.
Changelog
- 0.1.3: Output, dataset and key-value store schemas, as Apify asks for publication: the Output tab of a run started from the Console shows the connection details and one row per tool.
- 0.1.2: the Input tab shows the endpoint and how to connect an AI client, and a run started from the Console outputs the connection details and the tool list
- 0.1.1: pricing events tool-read and tool-action
- 0.1.0: initial build (private, unpublished)