VulnFeed MCP server

by novadyne-hq·io.github.novadyne-hq/vulnfeed·v0.3.9

Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402.

B80/100grade B

What users say

No reviews yet

Safety scan

B80/100

Adoption

Growing

1 stars40 downloads/wk

Reviews

Nobody has reviewed VulnFeed yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

_query_worker
check_alerts
Check for new vulnerabilities since the last scan of a monitored project.
check_package
Check a single package for known vulnerabilities.
list_monitored
List all projects registered for vulnerability monitoring.
lookup_cve
Look up detailed information about a specific vulnerability.
monitor_project
Register a project for continuous vulnerability monitoring.
scan_lockfile
Scan a lockfile for known vulnerabilities.
scan_project
Auto-detect and scan all lockfiles in a project directory.
set_webhook
Set, rotate or remove the webhook for a monitored project.
unmonitor_projectwrite action
Remove a project from vulnerability monitoring.
update_depswrite action
Update a monitored project's dependency snapshot after upgrading packages.

scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it

no findings

Code scan6 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 1 days ago15/15
Maintainer identityregistry namespace matches repository owner6/10

Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

claude mcp add vulnfeed -- uvx vulnfeed-mcp

Is VulnFeed MCP server safe?: Mostly: it is graded B (80/100). Read the VulnFeed safety report
How do I install VulnFeed?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does VulnFeed need an API key?: Yes. The registry entry asks for VULNFEED_API_KEY.
Is VulnFeed maintained?: The last commit was 2 days ago (2026-09-19). The latest release is v0.3.9.