vulnerable.now

Connect Remote server

claude mcp add --transport http mcp https://vulnerable.now/mcp

{
  "mcpServers": {
    "mcp": {
      "url": "https://vulnerable.now/mcp"
    }
  }
}

{
  "servers": {
    "mcp": {
      "type": "http",
      "url": "https://vulnerable.now/mcp"
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://vulnerable.now/mcp

Tools 8 found in our last check

• get_vulnerability

  Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the description, CVSS, CISA KEV status, EPSS, public exploits, affected packages, fixed versions, priority and source links.

• get_poc

  List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is…

• search

  Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.

• get_package

  Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that package. Give a version to learn which advisories affect it and the lowest upgrade that leaves every affecting range.

• get_product

  Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with the affected versions and fixes. The vendor is optional: with only a product name, a clear match is answered directly and otherwise the candid…

• list_feed

  List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit code, fix availability, ecosystem, vendor, product, text and dates. Use modified_since to pick up changes since a previous run.

• top_priority

  What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activity in a time window, optionally narrowed to an ecosystem, vendor or product.

• check_stack

  Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a lockfile (package-lock.json, poetry.lock, go.sum and others), a CycloneDX or SPDX SBOM, a Wappalyzer export, or detected technologies such as…

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.