VulnFeed
9 security tools your AI agent can call
Last verified:
What is VulnFeed?
VulnFeed is an MCP (Model Context Protocol) server that monitors your project's dependencies for security vulnerabilities. It reads your lockfile (package-lock.json, requirements.txt, or go.sum), checks the National Vulnerability Database (NVD) and GitHub Advisories, and identifies which vulnerabilities actually affect your dependency tree. The tool prioritizes findings by real-world exploit probability using EPSS (Exploit Prediction Scoring System) and provides exact fix versions for each vulnerability.
Key features include EPSS prioritization to filter out CVE noise, fix recommendations with exact upgrade versions (cross-referencing npm, PyPI, and Go registries), continuous monitoring that updates within 15 minutes of new CVE publications, and 9 MCP tools covering scan, lookup, monitor, and alert functions. It works natively in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf with a 2-minute setup requiring no signup for the free tier.
VulnFeed is designed for developers, security engineers, and AI agents using MCP-compatible clients who need proactive dependency vulnerability monitoring. It eliminates noise from packages you don't use, surfaces vulnerabilities likely to be used in real attacks, and provides actionable fix recommendations rather than just alerts. The flat-rate pricing ($14/mo) makes it accessible compared to per-seat enterprise solutions.
VulnFeed pricing
Pricing model: Freemium
Free tier: 10 scans/day, 1 monitored project, no signup required, no API key needed. Paid plan: $14/mo flat rate for unlimited scans and unlimited monitored projects, flat rate not per-seat or per-repo, requires license key. x402 micropayments: $0.01 per scan, $0.002 per CVE lookup, $0.05 per monitor, pays with USDC on Base via Coinbase facilitator, no account or subscription required, instant settlement.
VulnFeed pros
- Reads your actual lockfile and filters to only CVEs in your dependency tree
- EPSS prioritization surfaces vulnerabilities likely to be exploited in real attacks
- Provides exact fix versions with cross-referenced npm, PyPI, and Go registry data
- Continuous monitoring updates within 15 minutes of new CVE publications
- 9 MCP tools covering scan, lookup, monitor, check alerts, and update deps
- Free tier offers 10 scans/day with no signup required
- Works natively in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf
- 2-minute setup with zero configuration for free tier
- Flat $14/mo pricing not per-seat or per-repo
- x402 micropayment option at $0.01 per scan for AI agents
- Zero upstream cost since data sources (NVD, GitHub, EPSS) are free public APIs
- No vendor lock-in or data broker middlemen
- Filters noise from packages you don't actually use
- Monitors 1 project on free tier without API key
- Unlimited scans and unlimited monitored projects on paid plan
VulnFeed cons
- Free tier limited to 10 scans/day and only 1 monitored project
- Requires MCP-compatible client (Claude Code, Cursor, VS Code, etc.)
- Paid plan costs $14/mo which may be expensive for individual hobbyists
- x402 micropayments require USDC on Base cryptocurrency
- Only supports lockfiles (package-lock.json, requirements.txt, go.sum)
- No standalone web interface - MCP server only
- Unlimited plan requires license key setup in environment variables
- Depends on third-party free APIs (NVD, GitHub, EPSS) that could change
Frequently asked questions about VulnFeed
What is VulnFeed and what does it do?
VulnFeed is an MCP server that monitors your project's dependencies for security vulnerabilities. It reads your lockfile (package-lock.json, requirements.txt, or go.sum), checks NVD and GitHub Advisories, prioritizes vulnerabilities by real-world exploit probability using EPSS scoring, and provides exact fix versions for upgrading vulnerable packages.
How do I set up VulnFeed?
Add VulnFeed to your MCP config with command 'uvx' and args ['vulnfeed-mcp']. For the free tier, no signup or API key is needed. For unlimited usage, add your license key to the VULNFEED_API_KEY environment variable. Restart your MCP client (Claude Code, Cursor, VS Code, etc.) and ask it to 'scan my project for vulnerabilities'.
What is EPSS prioritization?
EPSS (Exploit Prediction Scoring System) scores each CVE by its real-world exploitability probability. VulnFeed uses EPSS to surface only the vulnerabilities likely to be used in real attacks, filtering out the noise from most CVEs that remain unexploited. For example, a vulnerability with 73.2% EPSS score is marked HIGH priority while one with 0.8% is low priority.
What MCP tools does VulnFeed provide?
VulnFeed provides 9 MCP tools: scan a lockfile, check a package, look up a CVE, monitor a project, check alerts, update dependencies, and list projects. These cover everything needed for a complete security workflow around dependency vulnerability monitoring.
How fast is continuous monitoring?
VulnFeed updates its index within 15 minutes of new CVE publications. If a new CVE is published at 3am, it's in the index by 3:15am for your morning session. You register your project once and can check back any time for new vulnerabilities.
Which development tools support VulnFeed?
VulnFeed works in Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf. These are all MCP-compatible clients that can load the vulnfeed-mcp server through their MCP configuration.
What lockfile formats does VulnFeed support?
VulnFeed reads package-lock.json (Node.js/npm), requirements.txt (Python/pip), and go.sum (Go) lockfiles. It filters vulnerabilities to only those affecting your actual dependency tree from these files.
How does x402 micropayment work?
AI agents can pay per request with USDC on Base blockchain using the x402 protocol. Your agent gets a HTTP 402 response with payment details, the x402 client library handles the $0.01 payment automatically, and you get results instantly. No account, API key, or subscription required. Settlement is instant via Coinbase facilitator with no middleman.
What data sources does VulnFeed use?
VulnFeed uses NVD (National Vulnerability Database), GitHub Advisory Database, and EPSS (Exploit Prediction Scoring System). All three are free, public APIs with zero upstream cost. Your $14/mo pays for the intelligence layer (prioritization, fix recommendations, monitoring) not data access.
How does VulnFeed compare to Snyk or Socket?
VulnFeed matches Snyk/Socket on CVE lookup, knowing your deps, EPSS prioritization, fix recommendations, and continuous monitoring. However, VulnFeed is MCP-native (Snyk/Socket are not), has a free tier with 10 scans/day (Snyk/Socket have no free tier), offers x402 micropayments, and costs $14/mo flat versus $25-49 per developer per month for enterprise solutions.