# Vulnerability Intelligence MCP Server (`mrbridge/vuln-intel-mcp`) Actor

Vulnerability intelligence MCP server for Claude, ChatGPT, Cursor and other AI agents. Scan up to 100 pinned dependencies for known vulnerabilities and fixed versions, read CVE records from the NVD with CVSS, CWE and known-exploited dates, and follow the newest CVEs. Read-only.

- **URL**: https://apify.com/mrbridge/vuln-intel-mcp.md
- **Developed by:** [MrBridge](https://apify.com/mrbridge) (community)
- **Categories:** MCP servers, AI, Developer tools
- **Security:** Limited permissions
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 read operations

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## 🛡️ Vulnerability Intelligence MCP Server

Vulnerability Intelligence MCP Server is an MCP server that gives Claude, ChatGPT, Cursor, VS Code and other AI agents two public vulnerability databases in one place: OSV.dev for package advisories and fixed versions, and the National Vulnerability Database (NVD) for CVE records with CVSS scores, CWE weaknesses and CISA Known Exploited Vulnerabilities (KEV) dates. Its 10 read-only tools scan dependencies, read advisories and CVEs, and list the newest CVEs and KEV additions.

Paste a lockfile and ask Claude "which of these dependencies have known vulnerabilities, and what should I upgrade to?". It calls `vuln_check_dependencies` on up to 100 pinned packages and returns the severity and the fixed versions for each one. Then ask "is CVE-2021-44228 on the KEV list, and what changed on it since publication?" to get the dates, the required action and the change history.

**This product uses the NVD API but is not endorsed or certified by the NVD.**

### Quick start

1. Copy your API token from [Apify Console > Settings > API & Integrations](https://console.apify.com/settings/integrations).
2. Add `https://mrbridge--vuln-intel-mcp.apify.actor/mcp` to your AI client with the header `Authorization: Bearer <token>`. The Connect section below has a ready-made snippet for each client.
3. Ask a question such as "list the critical CVEs published in the last two days".

### What this server exposes

This server gives an AI client 10 read-only tools over two public vulnerability databases. From OSV.dev, which gathers the GitHub Advisory Database, the PyPI, Go and RustSec databases and many Linux distributions, it checks one package version, or a list of up to 100 pinned dependencies, for known vulnerabilities and the versions that fix them, and reads any advisory by its id. From the National Vulnerability Database (NVD) run by NIST, it reads CVE records with their CVSS scores, CWE weaknesses and CISA Known Exploited Vulnerabilities (KEV) dates, searches CVEs by keyword or weakness, lists the latest CVEs and the latest KEV additions, finds the CPE name of a product and lists its CVEs, and shows how a CVE changed over time. You need no account or API key with either source, and every answer names its sources and their licences. The tools only read public data: they scan no system and return no exploit code.

**This product uses the NVD API but is not endorsed or certified by the NVD.** This server is not affiliated with or endorsed by NIST, the NVD, Google, the OpenSSF or the databases that OSV.dev aggregates.

### Tools

| Tool | What it answers | Billed event |
|---|---|---|
| `vuln_check_package` | Check a package version for known vulnerabilities | `tool-read` |
| `vuln_check_dependencies` | Check a list of dependencies for known vulnerabilities | `tool-action` |
| `vuln_get_advisory` | Get an open source vulnerability advisory by id | `tool-read` |
| `vuln_get_cve` | Get CVE details from the NVD | `tool-read` |
| `vuln_search_cves` | Search CVEs in the NVD by keyword or weakness | `tool-read` |
| `vuln_list_recent_cves` | List CVEs published in the last days | `tool-read` |
| `vuln_list_exploited_cves` | List CVEs recently added to the CISA KEV catalogue | `tool-read` |
| `vuln_list_product_cves` | List CVEs affecting a product (CPE) | `tool-read` |
| `vuln_search_products` | Find the CPE name of a product in the NVD dictionary | `tool-read` |
| `vuln_get_cve_history` | Get the change history of a CVE in the NVD | `tool-read` |

#### `vuln_check_package`: Check a package version for known vulnerabilities

Use this when you need to know whether one open source package, at one version, is affected by known vulnerabilities, and which versions fix them, from OSV.dev (GitHub, PyPI, Go, RustSec and other advisory databases). Do not use for several packages at once (use vuln_check_dependencies), for one advisory id (use vuln_get_advisory), or for CVSS scores and CISA KEV status of a CVE (use vuln_get_cve). Parameters: `ecosystem` (e.g. "npm", "PyPI", "Debian:12") and `package_name` (e.g. "lodash"), or `purl` (e.g. "pkg:npm/lodash@4.17.20"), `version` (optional, e.g. "4.17.20", without it every recorded vulnerability of the package is listed and vulnerable is null), `limit` (1-50, default 20, max 10 when detailed), `offset` (default 0), `response_format` ("concise" default, "detailed" adds shortened details, affected ranges and references). Newest advisories first.

| Parameter | Type | Required | Example |
|---|---|---|---|
| `ecosystem` | string | no | `"npm"` |
| `package_name` | string | no | `"lodash"` |
| `version` | string | no | `"4.17.20"` |
| `purl` | string | no | `"pkg:npm/lodash@4.17.20"` |
| `limit` | integer | no | `20` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ package, vulnerable, vulnerability_count, total_is_lower_bound, vulnerabilities[], notes[], pagination, attribution }`. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.

#### `vuln_check_dependencies`: Check a list of dependencies for known vulnerabilities

Use this when you need to scan a list of pinned dependencies (a lockfile, an SBOM, a requirements list) for known vulnerabilities in one call, from OSV.dev, with severity and fixed versions for each package. Do not use for one package (use vuln_check_package), for version-less package names, or for NVD scores and KEV status (use vuln_get_cve with the CVE aliases). Parameters: `packages` (array of 1 to 100 items, each `ecosystem` + `package_name` + `version`, e.g. {"ecosystem":"npm","package_name":"lodash","version":"4.17.20"}, or a versioned `purl`, e.g. {"purl":"pkg:pypi/jinja2@2.4.1"}), `limit` (packages per page, 1-100, default 50), `offset` (default 0), `response_format` ("concise" default, "detailed" adds shortened advisory details and references). Advisories of each page are loaded for at most 30 ids.

| Parameter | Type | Required | Example |
|---|---|---|---|
| `packages` | array of object | yes | `[{"ecosystem":"npm","package_name":"lodash","version":"4.17.20"},{"purl":"pkg:pypi/jinja2@2.4.1"}]` |
| `limit` | integer | no | `50` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ summary, packages[], advisories[], notes[], pagination, attribution }`. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.

#### `vuln_get_advisory`: Get an open source vulnerability advisory by id

Use this when you have an advisory id (GHSA, PYSEC, GO, RUSTSEC, OSV, MAL, CVE and other OSV.dev ids) and need its summary, aliases, affected packages with introduced and fixed versions, and references. Do not use for NVD CVSS scores, CWE or CISA KEV status (use vuln_get_cve), or to find advisories of a package (use vuln_check_package). Parameters: `id` (string, case-insensitive, e.g. "GHSA-jfh8-c2jp-5v3q", "PYSEC-2021-19", "RUSTSEC-2021-0001", "CVE-2021-44228"), `response_format` ("concise" default: 800 characters of details, 30 packages, 10 references, "detailed": 4,000 characters, 100 packages, 50 references). The answer suggests a vuln_get_cve call for CVE aliases.

| Parameter | Type | Required | Example |
|---|---|---|---|
| `id` | string | yes | `"GHSA-jfh8-c2jp-5v3q"` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ advisory, affected_packages[], affected_packages_total, cve_ids[], next_calls[], notes[], attribution }`. Upstream: OSV.dev. Cache: hourly (1 hour). Read-only.

#### `vuln_get_cve`: Get CVE details from the NVD

Use this when you need the NVD record of one or more CVEs: description, CVSS scores and vectors, CWE ids, CISA Known Exploited Vulnerabilities (KEV) dates and required action, vulnerable CPE configurations and references. Do not use for open source package advisories and fixed package versions (use vuln_get_advisory or vuln_check_package), or to find CVEs by keyword (use vuln_search_cves). Parameters: `cve_ids` (array of 1 to 10 CVE ids, case-insensitive, e.g. \["CVE-2021-44228"], asked in one NVD request), `response_format` ("concise" default, "detailed" for at most 2 ids adds every metric with vectors, SSVC, vendor comments, 50 references and 100 CPE criteria). Descriptions are verbatim NVD text.

| Parameter | Type | Required | Example |
|---|---|---|---|
| `cve_ids` | array of string | yes | `["CVE-2021-44228"]` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ cves[], not_found[], notes[], attribution }`. Upstream: NVD. Cache: daily (1 day). Read-only.

#### `vuln_search_cves`: Search CVEs in the NVD by keyword or weakness

Use this when you need to find CVEs by keyword in their description (product, vendor, technology) or by CWE weakness, optionally filtered by CVSS severity, publication dates and CISA KEV listing, newest first, from the NVD. Do not use for the latest CVEs without a keyword (use vuln_list_recent_cves), for CVEs of one exact product version (use vuln_list_product_cves), or for open source packages (use vuln_check_package). Parameters: `keyword` (e.g. "FortiOS") and or `cwe_id` (e.g. "CWE-79"), at least one, `exact_phrase` (default false), `severity` ("LOW", "MEDIUM", "HIGH", "CRITICAL"), `cvss_version` ("v3" default or "v4"), `published_from` and `published_to` ("YYYY-MM-DD", at most 120 days apart), `known_exploited_only` (default false), `limit` (1-20, default 10), `offset` (default 0), `response_format` ("concise" default, "detailed" adds CWE, KEV dates and tags).

| Parameter | Type | Required | Example |
|---|---|---|---|
| `keyword` | string | no | `"FortiOS"` |
| `exact_phrase` | boolean | no | `false` |
| `cwe_id` | string | no | `"CWE-79"` |
| `severity` | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | `"CRITICAL"` |
| `cvss_version` | "v3" or "v4" | no | `"v3"` |
| `published_from` | string | no | `"2026-06-01"` |
| `published_to` | string | no | `"2026-09-27"` |
| `known_exploited_only` | boolean | no | `false` |
| `limit` | integer | no | `10` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ query, cves[], notes[], pagination, attribution }`. Upstream: NVD. Cache: daily (1 day). Read-only.

#### `vuln_list_recent_cves`: List CVEs published in the last days

Use this when you need the CVEs the NVD published over the last days, newest first, optionally only critical or high ones, or only those in the CISA KEV catalogue, for a vulnerability watch or a daily briefing. Do not use for a keyword or product search (use vuln_search_cves or vuln_list_product_cves), or for recent additions to the KEV catalogue whatever the CVE date (use vuln_list_exploited_cves). Parameters: `days` (1-30, default 7, the window ends at the start of the current UTC hour), `severity` ("LOW", "MEDIUM", "HIGH", "CRITICAL"), `cvss_version` ("v3" default or "v4"), `known_exploited_only` (default false), `limit` (1-20, default 10), `offset` (default 0), `response_format` ("concise" default, "detailed" adds CWE, KEV dates and tags).

| Parameter | Type | Required | Example |
|---|---|---|---|
| `days` | integer | no | `3` |
| `severity` | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | `"CRITICAL"` |
| `cvss_version` | "v3" or "v4" | no | `"v3"` |
| `known_exploited_only` | boolean | no | `false` |
| `limit` | integer | no | `10` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ query, cves[], notes[], pagination, attribution }`. Upstream: NVD. Cache: hourly (1 hour). Read-only.

#### `vuln_list_exploited_cves`: List CVEs recently added to the CISA KEV catalogue

Use this when you need the vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalogue over the last days, newest addition first, with the due date and the CISA vulnerability name, as recorded by the NVD. Do not use for CVEs published recently whatever their exploitation (use vuln_list_recent_cves), or to check one CVE (use vuln_get_cve, its kev block). Parameters: `days` (1-120, default 30, the window ends at the start of the current UTC hour), `limit` (1-20, default 10), `offset` (default 0), `response_format` ("concise" default, "detailed" adds the CISA required action, CWE and tags).

| Parameter | Type | Required | Example |
|---|---|---|---|
| `days` | integer | no | `30` |
| `limit` | integer | no | `10` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ query, cves[], notes[], pagination, attribution }`. Upstream: NVD. Cache: hourly (1 hour). Read-only.

#### `vuln_list_product_cves`: List CVEs affecting a product (CPE)

Use this when you need the CVEs the NVD maps to one product, by its CPE 2.3 name: one version ("cpe:2.3:a:apache:http_server:2.4.49") or every version ("cpe:2.3:a:apache:http_server"), newest first. Do not use for finding the CPE name of a product (use vuln_search_products first), for open source packages by ecosystem (use vuln_check_package), or for a free-text search (use vuln_search_cves). Parameters: `cpe` (CPE 2.3 name, e.g. "cpe:2.3:a:apache:http_server:2.4.49"), `vulnerable_only` (default true, versioned CPE only), `severity` ("LOW", "MEDIUM", "HIGH", "CRITICAL"), `cvss_version` ("v3" default or "v4"), `limit` (1-20, default 10), `offset` (default 0), `response_format` ("concise" default, "detailed" adds CWE, KEV dates and tags).

| Parameter | Type | Required | Example |
|---|---|---|---|
| `cpe` | string | yes | `"cpe:2.3:a:apache:http_server:2.4.49"` |
| `vulnerable_only` | boolean | no | `true` |
| `severity` | "LOW" or "MEDIUM" or "HIGH" or "CRITICAL" | no | `"CRITICAL"` |
| `cvss_version` | "v3" or "v4" | no | `"v3"` |
| `limit` | integer | no | `10` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ query, cves[], notes[], pagination, attribution }`. Upstream: NVD. Cache: daily (1 day). Read-only.

#### `vuln_search_products`: Find the CPE name of a product in the NVD dictionary

Use this when you need the official CPE 2.3 name of a product and version (software, operating system or hardware) from the NVD CPE dictionary, to list its CVEs with vuln_list_product_cves. Do not use for vulnerabilities themselves (use vuln_list_product_cves or vuln_search_cves), or for open source packages identified by ecosystem (use vuln_check_package). Parameters: `keyword` (e.g. "apache http server 2.4.49", every word must appear in the title) or `cpe_match` (a CPE prefix, e.g. "cpe:2.3:a:apache:http_server"), one of the two, `limit` (1-50, default 20), `offset` (default 0), `response_format` ("concise" default, "detailed" adds the CPE id, creation date and references). Each product carries its next_call.

| Parameter | Type | Required | Example |
|---|---|---|---|
| `keyword` | string | no | `"apache http server 2.4.49"` |
| `cpe_match` | string | no | `"cpe:2.3:a:apache:http_server"` |
| `limit` | integer | no | `20` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ products[], notes[], pagination, attribution }`. Upstream: NVD. Cache: daily (1 day). Read-only.

#### `vuln_get_cve_history`: Get the change history of a CVE in the NVD

Use this when you need what changed on one CVE in the NVD and when: initial analysis, CVSS rescoring, CWE or CPE changes, reference tags, CISA KEV updates, rejection, newest event first. Do not use for the current state of the CVE (use vuln_get_cve) or for the history of open source advisories (use vuln_get_advisory, its modified date). Parameters: `cve_id` (string, case-insensitive, e.g. "CVE-2024-3094"), `limit` (1-50, default 20), `offset` (default 0), `response_format` ("concise" default: event, date, source and the type of each change, "detailed": old and new values verbatim).

| Parameter | Type | Required | Example |
|---|---|---|---|
| `cve_id` | string | yes | `"CVE-2021-44228"` |
| `limit` | integer | no | `20` |
| `offset` | integer | no | `0` |
| `response_format` | "concise" or "detailed" | no | `"concise"` |

Returns `{ cve_id, url, events[], notes[], pagination, attribution }`. Upstream: NVD. Cache: daily (1 day). Read-only.

### Connect

Endpoint (Streamable HTTP): `https://mrbridge--vuln-intel-mcp.apify.actor/mcp`

Every client authenticates with your Apify API token, found in [Apify Console > Settings > API & Integrations](https://console.apify.com/settings/integrations). Clients that support custom headers send it as `Authorization: Bearer <token>`. The others use the `?token=` URL variant, which must be treated as a secret: keep it out of commits, screenshots and shared logs.

#### Claude Code

```bash
claude mcp add --transport http vuln-intel "https://mrbridge--vuln-intel-mcp.apify.actor/mcp" --header "Authorization: Bearer ${APIFY_TOKEN}"
```

#### Cursor, VS Code and other JSON configurations

```json
{
  "mcpServers": {
    "vuln-intel": {
      "type": "http",
      "url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer ${APIFY_TOKEN}"
      }
    }
  }
}
```

#### claude.ai and Claude Desktop

Add a custom connector with the URL `https://mrbridge--vuln-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN` and no authentication. Prefilled link (replace the token placeholder before saving): [add Vulnerability Intelligence MCP Server to Claude](https://claude.ai/customize/connectors?modal=add-custom-connector\&connectorName=Vulnerability%20Intelligence%20MCP%20Server\&connectorUrl=https%3A%2F%2Fmrbridge--vuln-intel-mcp.apify.actor%2Fmcp%3Ftoken%3DYOUR_APIFY_TOKEN).

#### ChatGPT (developer mode)

Settings > Apps > Create, URL `https://mrbridge--vuln-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN`, authentication "No authentication". ChatGPT snapshots the tool list: after a server update, an admin has to click Refresh on the app.

#### OpenAI Responses API

```json
{
  "type": "mcp",
  "server_label": "vuln_intel",
  "server_url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp",
  "headers": {
    "Authorization": "Bearer YOUR_APIFY_TOKEN"
  },
  "require_approval": "never"
}
```

Add `allowed_tools` to restrict the tool list. Tool calls must finish within about 60 seconds on this API, and every tool of this server answers in under 50 seconds.

#### Anthropic Messages API

```json
{
  "mcp_servers": [
    {
      "type": "url",
      "url": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp",
      "name": "vuln-intel",
      "authorization_token": "YOUR_APIFY_TOKEN"
    }
  ],
  "tools": [
    {
      "type": "mcp_toolset",
      "mcp_server_name": "vuln-intel"
    }
  ]
}
```

Send the beta header `anthropic-beta: mcp-client-2025-11-20`.

#### One-click OAuth alternative

`https://mcp.apify.com/?tools=mrbridge/vuln-intel-mcp` connects through Apify OAuth without a token. It exposes the Actor as a single tool rather than the granular tools listed above.

#### Cost control

Each Standby run has a spending limit (`maxTotalChargeUsd`). When a call uses the last of it, the result is still returned, and later calls in that run answer `CHARGE_LIMIT_REACHED` until the limit is raised.

### Why use Vulnerability Intelligence MCP Server

- **Two databases, one server.** Package-level advisories with fixed versions from OSV.dev, and CVE-level CVSS, CWE and KEV dates from the NVD.
- **Whole dependency lists.** Up to 100 pinned packages per call from a lockfile, a requirements file or an SBOM, with severity and fixed versions per package.
- **Newest first.** Latest CVEs, latest KEV additions, keyword searches and the CVEs of a product, sorted newest first, which the NVD API does not do on its own.
- **Licence-aware answers.** Every record names its home database and licence, so you know how you may reuse it.
- **Read-only by design.** No scanning of hosts and no exploit code. The tools read public data only.

### Pricing (Pay-per-Event)

Vulnerability Intelligence MCP Server uses pay-per-event pricing. Each successful call is one `tool-read` event at $0.005, or one `tool-action` event at $0.01 for a dependency scan with `vuln_check_dependencies`, so 1,000 reads cost $5 in events, and a scan of 100 dependencies is a single `tool-action` event. These are the FREE plan prices, and Apify plan discounts lower them. Apify also bills its standard `apify-actor-start` event when a Standby run starts, and you pay the platform usage of your own Standby run on top of the events, as explained below. Calls that end in an error carry no event charge. See the [Pricing tab](https://apify.com/mrbridge/vuln-intel-mcp/pricing) for the price on your Apify plan.

| Event | Charged when | Price |
|---|---|---|
| `apify-actor-start` | run start (platform default) | see the Store page |
| `tool-read` (primary event) | each successful read tool call | see the Store page |
| `tool-action` | each successful call of a detailed or computed tool | see the Store page |

Never charged: initialize, tools/list, pings, readiness probes, and any call that ends in an error (invalid input, not found, upstream failure, timeout, spending limit).

Platform usage comes on top of these events. This server runs in Apify Standby mode, and you also pay the platform usage of your own Standby run, billed to your Apify account like any other run: the memory set for the Standby run, for as long as the server is up, idle time included, until the run stops at its idle timeout.
The [Apify pay-per-event documentation](https://docs.apify.com/actors/publishing/monetize/pay-per-event#platform-usage-costs) says so: "For runs in Standby mode, users always pay the platform usage costs in addition to the event charges."

### Limits, caveats and attribution

- **Attribution.** Every answer carries an `attribution` block: the provider, the source, the terms URL and the notices below. For OSV.dev it also lists the home database and licence of the records returned. Keep it when you reuse the data.
- **NVD notice and CVE licence.** Every NVD answer carries the notice above. Every answer with CVE content also reproduces MITRE's copyright designation and the licence of the [CVE Terms of Use](https://www.cve.org/Legal/TermsOfUse). NVD descriptions, scores, vectors and references come through unchanged: a long answer returns fewer rows, never shorter texts. `headline_severity` is picked by this server among the scores the NVD publishes (CVSS 3.1 first, and the NVD or the CNA of the record before other sources).
- **NVD rate limit.** Without a key, the NVD allows 5 requests in a rolling 30 seconds per IP address. This server keeps to half of that, queues requests in order, caches answers (one day, or one hour for the recent and KEV lists) and never retries an NVD request. When the queue would outlast the time budget of a call, the call answers `UPSTREAM_RATE_LIMITED` with the wait in its hint. Other Apify users on the same outgoing IP address share that keyless quota. With an owner key the limit rises to 50 requests per 30 seconds.
- **NVD coverage.** Since April 2026 the NVD enriches prioritised CVEs first (KEV, software used by the US federal government, critical software). Many recent CVEs carry only the score of the CNA that published them, or no score at all, so a severity filter can hide them. The recent list ends at the start of the current hour (UTC).
- **OSV.dev licences.** Each record keeps the licence of its home database: CC BY 4.0 for GitHub, PyPI, Go and OSS-Fuzz, CC0 for RustSec, CC BY-SA 4.0 for Ubuntu, and others. OSV.dev does not document the licence of some databases (Debian, Red Hat, SUSE, Alpine and Chainguard among them), so their records come as identifiers, dates, package names, fixed versions and a link only. Records are reshaped, and long texts end with the marker `[shortened by vuln-intel-mcp]`.
- **OSV.dev results.** A package check returns the first page that OSV.dev sends (about 1,000 advisories) and sets `total_is_lower_bound` when more exist. A clean answer means that OSV.dev knows no vulnerability for that package and version: OSV.dev cannot tell it apart from a misspelled package name or a wrong ecosystem. Answers are cached for one hour.
- **Not included.** Breach and password checks (Have I Been Pwned) are not part of this server.

### Data terms

By using this server you agree to use the data it returns in line with the terms of each source, and to pass the same obligations on to anyone you share the data with.

- NVD: [NVD API Terms of Use](https://nvd.nist.gov/developers/terms-of-use). Show "This product uses the NVD API but is not endorsed or certified by the NVD." where you display the data, do not use the NVD name to suggest endorsement, and do not present modified content as coming from the NVD.
- CVE records: [CVE Terms of Use](https://www.cve.org/Legal/TermsOfUse). Keep MITRE's copyright designation and the CVE licence with any copy.
- OSV.dev records: the licence of each home database, listed in `attribution.sources` and on the [OSV.dev data sources page](https://google.github.io/osv.dev/data/). Credit the database, keep its licence, say when you change a record, and share adapted Ubuntu material under CC BY-SA 4.0.

The fee for this server pays for the service (hosting, caching, normalisation), not for a licence on the data.

### Use cases

- **Dependency triage.** Paste a lockfile into the chat and get the vulnerable packages with the version that fixes each one.
- **SBOM review.** Check the pinned components of a software bill of materials before a release or a customer audit.
- **Daily vulnerability briefing.** "Critical CVEs published in the last two days" and "what did CISA add to the KEV catalogue this week?"
- **Incident research.** Open a CVE with its CVSS vectors, CWE, affected configurations, references and change history.
- **Asset exposure.** Find the CPE name of a product, then list the CVEs that affect one version of it.
- **Security writing.** Quote exact CVE details and advisory texts in reports and newsletters, credited under their licences.

The answers are informational. A clean result means that the databases know no vulnerability for that package and version, not that the software is safe.

### More developer and security tools

- [open source dependency check MCP](https://apify.com/mrbridge/oss-intel-mcp): advisories, typosquatting look-alikes and licences for JavaScript, Python and Rust dependencies.
- [developer Q\&A search for AI](https://apify.com/mrbridge/dev-communities-mcp): Stack Overflow questions similar to your error, with accepted and top answers.
- [domain WHOIS and RDAP lookup MCP](https://apify.com/mrbridge/web-intel-mcp): a domain's registrar, age, expiry date and name servers over RDAP, for over 500 TLDs.

### FAQ

#### Why is the first call slower?

The server runs in Apify Standby mode. When no request comes in for a while, the run stops at its idle timeout, and the next call starts a new one. That cold start took about 5 seconds in the last platform test. Calls made while the server is warm skip the delay.

#### Why can NVD calls be slow or fail?

The NVD accepts a small number of requests per 30 seconds. This server queues NVD requests, keeps to half of the limit and caches answers for one hour to one day. When the queue would outlast the time budget of a call, the call answers `UPSTREAM_RATE_LIMITED` with the wait in its hint. The NVD itself is sometimes down or slow, and the call then answers `UPSTREAM_UNAVAILABLE` or `TIMEOUT`. None of these calls carries an event charge, and a retry a little later usually works.

#### Why do some recent CVEs have no CVSS score?

Since April 2026 the NVD enriches prioritised CVEs first. Many recent CVEs carry only the score of the organisation that published them, or no score yet, so a severity filter can leave them out.

#### Which package managers does the dependency scan cover?

All the sources OSV.dev indexes, including npm, PyPI, Go, crates.io and Maven, plus many Linux distributions. For some distributions OSV.dev documents no licence, so their records come as identifiers, versions and a link only.

#### Does it check passwords or data breaches?

No. Breach and password checks are not part of this server.

#### Where do I check licences and typosquats?

The companion [Open Source Dependency Check MCP Server](https://apify.com/mrbridge/oss-intel-mcp) covers licence reviews of whole dependency trees, look-alike package names and end-of-life dates.

#### Your feedback

Found a bug or a wrong answer? Open an issue on the [Issues tab](https://apify.com/mrbridge/vuln-intel-mcp/issues). Vulnerability Intelligence MCP Server is built by MrBridge. More servers are listed in the [MCP server catalogue](https://mr-bridge.com/mcp-servers), and more tools and data studies are at [mr-bridge.com](https://mr-bridge.com).

### Changelog

- 0.1.3: Output, dataset and key-value store schemas, as Apify asks for publication: the Output tab of a run started from the Console shows the connection details and one row per tool.
- 0.1.2: the Input tab shows the endpoint and how to connect an AI client, and a run started from the Console outputs the connection details and the tool list
- 0.1.1: pricing events tool-read and tool-action
- 0.1.0: initial build (private, unpublished)

# Actor input Schema

## `mcpEndpoint` (type: `string`):

Paste this URL into your MCP client (Streamable HTTP). It is shown here for copying only: the server ignores this form, and every parameter goes in your questions.

## Actor input object example

```json
{
  "mcpEndpoint": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp"
}
```

# Actor output Schema

## `connection` (type: `string`):

The item written by a run started from the Console: endpoint, token options, client recipes and the list of tools with the event each one bills.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "mcpEndpoint": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp"
};

// Run the Actor and wait for it to finish
const run = await client.actor("mrbridge/vuln-intel-mcp").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "mcpEndpoint": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp" }

# Run the Actor and wait for it to finish
run = client.actor("mrbridge/vuln-intel-mcp").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "mcpEndpoint": "https://mrbridge--vuln-intel-mcp.apify.actor/mcp"
}' |
apify call mrbridge/vuln-intel-mcp --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mrbridge/vuln-intel-mcp"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Ivj9SYkDJcD3vgPa6/builds/17xxDW348sGbMjXYm/openapi.json