How do I install the vulnfeed mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `VULNFEED_API_KEY` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

VulnFeed MCP Server

Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402.

Local serverstdioGo

What is the VulnFeed MCP Server?

Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402.

What it actually does

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
scan_project	Auto-detect and scan all lockfiles in a directory
scan_lockfile	Scan a specific lockfile
check_package	Check a single package for vulnerabilities
lookup_cve	Detailed CVE info with EPSS + fix versions (license key or x402)
monitor_project	Register for continuous monitoring (optional webhook_url for push alerts)
check_alerts	New vulns since last scan
set_webhook	Set, rotate or remove a project's webhook
update_deps	Update snapshot after upgrading packages
list_monitored	See all monitored projects
unmonitor_project	Remove from monitoring

How to install the VulnFeed MCP Server

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": [
        "vulnfeed-mcp"
      ]
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Example prompts to try

“Use VulnFeed to Scanning.”
“Use VulnFeed to Monitoring.”

Frequently asked questions

Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.

Alternatives to the VulnFeed MCP Server

NVD Database

Queries the NIST National Vulnerability Database (NVD) via its API.

DatabasesPython★ 14

Cursor Trivy

Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.

Security & IdentityPython★ 10

3ilm-mcp

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Security & Identity

A2adependencyinspector-mcp

Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi

Security & IdentityRemote

A2areplayreceipt-mcp

Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.