VulnTracker

Connect Remote server

claude mcp add --transport http mcp https://api.vulntracker.io/mcp --header "Authorization: Bearer <YOUR_API_KEY>"

{
  "mcpServers": {
    "mcp": {
      "url": "https://api.vulntracker.io/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

{
  "servers": {
    "mcp": {
      "type": "http",
      "url": "https://api.vulntracker.io/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://api.vulntracker.io/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 15 found in our last check

• add_to_board

  Add CVEs to the team's board (the API key's team) as cards, or update their status if a card already exists. Use after a scan when the user asks to put the findings on the board; write which dependency and version each CVE came from into notes. Up to 50 CVE ids per call, counted…

• check_dependencies

  Check many product@version pairs in one call. Give the dependencies you read from the repository's manifests (go.mod, package.json / lock files, requirements.txt, pom.xml, Gemfile.lock, Cargo.lock, Dockerfile base images). For each one you get whether VulnTracker matched a produ…

• check_version

  The core question: which CVEs affect this exact version of a product, and which version fixes each? Returns (a) CVEs whose claims name this version, with evidence, confidence and fix versions, and (b) range_affected_cves: CVEs whose source gave a version range that contains this…

• create_jira_issue

  Open a Jira issue for a CVE on the team's board (the card is created first if missing) using the team's Jira integration. Returns the issue key and URL; if the card already has an issue, returns that one with existing=true. Only when the user asks.

• list_board_cards

  The team's CVE board: the CVEs that reached this team (by tracking notification or added by hand), each with its triage status (new, acknowledged, in_progress, resolved, dismissed), resolution status, notes, severity and the vendor/product it was recorded against. Use it to answ…

• list_trackings

  The vendors, products, versions, CVEs, keywords and CPEs this account's team is watching in VulnTracker.

• lookup_cve

  Full record for one CVE: description, CVSS, EPSS, KEV/exploitation and SSVC, affected products with version ranges and fixes from the ledger, vendor advisories (CSAF), public exploit repositories, and VulnTracker's remediation guide when one is published.

• product_cves

  All CVEs recorded against a product in the affected-version ledger, newest first, with the version ranges each one names. entry_kind 'affected' = the product itself is vulnerable; 'runs_on_platform' = another product is vulnerable when running on it.

• product_versions

  List the versions VulnTracker knows for a product, with per-version CVE and fix counts. Use to find the exact version string before calling check_version.

• remediation_guide

  VulnTracker's published remediation guide for a CVE: summary, steps, workarounds, caveats, kind (fix / workaround / guidance) and the fix versions it rests on. Returns has_guide=false when none is published.

• search_cves

  Search the CVE list with filters. Results are newest first, up to 100 per call; when has_more is true pass next_cursor back as 'cursor' for the following page (at most 10 pages per filter set, so narrow the filters instead of walking the whole database). 'tracked_only' limits to…

• search_products

  Find VulnTracker products (software, firmware, libraries) by name. Returns slugs to use with check_version, product_versions and product_cves. Searches display names and known aliases (package names, CPE tokens).

• track

  Start watching something in VulnTracker for the API key's team: a product (default; slug or id from search_products / check_dependencies matched_slug), a vendor, a single CVE, or a keyword. New CVEs matching the tracking reach the team's board and its notification channels. Plan…

• untrack

  Remove a tracking from the API key's team: give the same type and target used with track (or shown by list_trackings). Board cards stay.

• update_board_card

  Change one board card: triage status (new, acknowledged, in_progress, resolved, dismissed), resolution (patched, mitigated, workaround, accepted_risk, false_positive), notes and resolution notes. Creates the card if the CVE is not on the board yet. Use when the user says a CVE i…

Headers

Details

More search and web servers See all

• Live Sports Scores & Betting Odds MCP Server

  Keyless sports scores, betting odds, injuries & news: NFL NBA MLB NHL soccer. No API key.

• Knowra

  Search arXiv papers and read Scout reports with methods, evidence and verification points.

• Contract Compass

  Korean public procurement law: rule-engine rulings, statutes search, live court precedents

• Korea Realty

  Korean real estate: court auctions, 10M+ MOLIT records, subscription notice facts, loan/DSR rules

• 校招宝 · 中国校园招聘岗位数据

  中国校园招聘（秋招/春招/实习/提前批）在招岗位、企业档案、投递截止与求职攻略数据。免 API Key、免注册、只读。

• IBDÅ

  Ask about IBDÅ, a design-led R&D and innovation studio in Dubai, and prepare a project enquiry.