cve.now MCP
cve.now by Sazabi provides a free public vulnerability feed, CVE/GHSA/OSV lookups, and exact package-version checks against its indexed catalog. No authentication required. No matches do not guarantee safety; model-written summaries are labeled and published under CC-BY 4.0, while upstream data retains its own licensing and attribution.
Needs no sign-in: agents can use it as it is.
Reads on its own3
Agents use these right away.
- Check stackCheck exact package versions against cve.now's synced vulnerability catalog using a lockfile or package list.
- Get vulnerabilityGet one vulnerability entry by CVE, GHSA or OSV id, as JSON.
- List feedList the newest items in a cve.now feed (critical, all, kev, tech/<slug>, ecosystem/<eco>).
Asks someone first0
Anything that sends, creates, changes or deletes waits for a person to approve it in the session’s chat.
None.