English Français العربية

VulnCheck

Official registry Search and web

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

Source code Documentation

What can you do with VulnCheck?

  • CVE research: Look up vulnerability details, severity, exploitability, and affected versions while reviewing code or triaging issues
  • Dependency analysis: Check packages by CPE or PURL to identify known vulnerabilities before shipping
  • Exploit intelligence: Determine whether a CVE has known exploit code, active exploitation, or C2 indicators
  • Advisory lookup: Search vendor and ecosystem advisories by package, product, or keyword
  • Index queries: Query VulnCheck's breach, botnet, and threat intelligence indices for real-time context

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

OCI package ghcr.io/vulncheck-oss/mcp:0.2.3
Claude Code 
claude mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "vulncheck": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/vulncheck-oss/mcp:0.2.3"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. The VulnCheck MCP Server
  2. Requirements
  3. Installation
  4. Available Tools
  5. Development

The VulnCheck MCP Server

The VulnCheck MCP Server connects AI assistants to VulnCheck vulnerability intelligence. Ask your AI tools about CVEs, exploits, advisories, and vulnerable packages — directly in your editor or terminal, using natural language.

Use Cases
  • CVE research: Look up vulnerability details, severity, exploitability, and affected versions while reviewing code or triaging issues
  • Dependency analysis: Check packages by CPE or PURL to identify known vulnerabilities before shipping
  • Exploit intelligence: Determine whether a CVE has known exploit code, active exploitation, or C2 indicators
  • Advisory lookup: Search vendor and ecosystem advisories by package, product, or keyword
  • Index queries: Query VulnCheck's breach, botnet, and threat intelligence indices for real-time context

Requirements

  • A VulnCheck API token — create one here

Installation

Download the latest release from the Releases page, or use the Docker image (ghcr.io/vulncheck-oss/mcp).

PlatformArchive
macOS (Apple Silicon)vulncheck-mcp_1.2.3_darwin_arm64.tar.gz
macOS (Intel)vulncheck-mcp_1.2.3_darwin_amd64.tar.gz
Linuxvulncheck-mcp_1.2.3_linux_amd64.tar.gz
Windowsvulncheck-mcp_1.2.3_windows_amd64.zip
Install in Your AI Client

Available Tools

See docs/tools.md for the full list of available tools.

Development

make build      # build for current platform → bin/vulncheck-mcp
make snapshot   # cross-compile all platforms via GoReleaser → dist/
make test       # run tests
make lint       # run golangci-lint

Frequently asked questions

What is VulnCheck?

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

How do I install VulnCheck?

It runs on your machine. In Claude Code: claude mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3. For other clients, paste the JSON configuration from this page into their MCP settings.

Does VulnCheck need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is VulnCheck open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains VulnCheck?

It is published by vulncheck-oss. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.