Skip to content
Agentmart
Submit a tool

crowbar

Retrieve CVEs and index them inside your codebase.

Connector by kushvinth · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 8
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/kushvinth-crowbar

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Retrieve CVEs and index them inside your codebase. One SQLite+FTS5 index, one CLI, one MCP server.

Use cases: security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
20 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 20

Read from the source code; the running server may list different tools.

Read 20 · Look things up without changing anything.

  • cb_advisory
  • cb_attack
  • cb_binary
  • cb_code
  • cb_cve
  • cb_cwe
  • cb_debian
  • cb_exploit
  • cb_kev
  • cb_models
  • cb_msf
  • cb_nuclei
Show 8 more tools
  • cb_os
  • cb_poc
  • cb_product
  • cb_search
  • cb_sources
  • cb_sql
  • cb_stats
  • cb_tables

Network hosts it talks to 41

  • anthropic.com · found in code
  • api.github.com · found in code
  • api.msrc.microsoft.com · found in code
  • apple.com · found in code
  • astral.sh · found in code
  • attack.mitre.org · found in code
  • capec.mitre.org · found in code
  • cdn.jsdelivr.net · found in code
  • cisa.gov · found in code
  • codeload.github.com · found in code
  • cwe.mitre.org · found in code
  • docs.astral.sh · found in code
  • epss.empiricalsecurity.com · found in code
  • exploit-db.com · found in code
  • files.pythonhosted.org · found in code
  • fortiguard.com · found in code
  • github.com · found in code
  • gitlab.com · found in code
  • googleprojectzero.blogspot.com · found in code
  • kb.cert.org · found in code
  • models.dev · found in code
  • msrc.microsoft.com · found in code
  • my.f5.com · found in code
  • nvd.nist.gov · found in code
  • openapi.vercel.sh · found in code
  • opencode.ai · found in code
  • oracle.com · found in code
  • osv-vulnerabilities.storage.googleapis.com · found in code
  • osv.dev · found in code
  • psirt.global.sonicwall.com · found in code
Show 11 more hosts
  • raw.githubusercontent.com · found in code
  • sec.cloudapps.cisco.com · found in code
  • seclists.org · found in code
  • security-tracker.debian.org · found in code
  • security.paloaltonetworks.com · found in code
  • support.apple.com · found in code
  • support.citrix.com · found in code
  • support.sap.com · found in code
  • vmware.com · found in code
  • wiki.zimbra.com · found in code
  • zerodayinitiative.com · found in code

Files it touches

  • Your home directory (~)
  • ~/.crowbar
  • Any path the agent passes to its tools

Tools (20)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • cb_advisory

    OSV/GHSA advisories with introduced/fixed version ranges. Filter by ecosystem (npm, PyPI, Go, Maven, NuGet, RubyGems, crates.io, Packagist, Debian, Alpine) or exact package name.

  • cb_attack

    MITRE ATT&CK technique lookup (enterprise, mobile, ics).

  • cb_binary

    Living-off-the-land binary abuse: GTFOBins (unix), LOLBAS (windows), PayloadsAllTheThings (web payloads).

  • cb_code

    Full-text search inside Exploit-DB source code; returns path + snippet.

  • cb_cve

    One CVE in full: CVSS, EPSS, KEV, CWE, CPE version ranges, references, Exploit-DB / Nuclei / Metasploit hits, SSVC decision points.

  • cb_cwe

    CWE definitions (id or keyword).

  • cb_debian

    Debian security tracker: per-release status and fixed version for a package.

  • cb_exploit

    Search the Exploit-DB index (46k entries), offline. To download the source for a numeric id, use the CLI: `crowbar exploit <id>`. Nothing is executed.

  • cb_kev

    CISA Known Exploited Vulnerabilities catalog.

  • cb_models

    LLM catalog: context window, price per M tokens, capabilities.

  • cb_msf

    Search Metasploit module paths.

  • cb_nuclei

    Search Nuclei templates; returns YAML paths for exact matchers.

  • cb_os

    Vendor OS advisories: Windows (MSRC Security Update Guide) and Apple iOS/iPadOS/macOS security releases. Filter by platform, impact (RCE, EoP, DoS, InfoDisclosure, Spoofing, Bypass) or exploited.

  • cb_poc

    Public GitHub PoC repositories (PoC-in-GitHub metadata). Never executed. Filter by CVE, language or minimum stars, or list the CVEs with the most PoCs.

  • cb_product

    CVEs affecting a product/vendor. Pass version to test NVD CPE version ranges, e.g. {name: nginx, version: 1.18.0}.

Show 5 more tools
  • cb_search

    Full-text search across every CVE (2002-today). Ranked by relevance blended with CISA KEV, EPSS and public-exploit availability. Filters: kev, exploit, min_epss, min_cvss, severity, year, since, cwe, product, vendor, ssvc, poc.

  • cb_sources

    Source provenance: which upstream source filled the index, its URL, license, SHA-256, load time and row count.

  • cb_sql

    Read-only SQL. Tables: cve, cve_cwe, cve_product, cpe_match, cve_ref, cve_exploit, cve_nuclei, cve_msf, kev, exploit, shellcode, nuclei, msf, attack, cwe, capec, model, ssvc, advisory, package_range, debian, os_advisory, toolkit, cve_cna, cve_meta, poc, poc_orphan, cve_alias, source_state, exploit_code_fts, toolkit_fts, meta.

  • cb_stats

    Corpus health and freshness. `index.age_days` is days since the last update; `index.stale` means older than the 8-day NVD change window, so recent CVEs may be missing or outdated - say so and run `crowbar update`.

  • cb_tables

    Data map: every index table, what it holds, and which command/dataset feeds it.

Signals

Stars
8
Forks
1
Open issues
0
Weekly downloads
419
Last commit
Oct 22, 2026 (6 days ago)
Last release
Oct 22, 2026 (6 days ago)
Last package publish
Oct 22, 2026 (6 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.kushvinth/crowbar
Version
0.1.3
Auth
No auth
Packages
pypi crowbar-cli
License
MIT
Repository
github.com/kushvinth/crowbar
Website
github.com/kushvinth/crowbar
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql
Cite this page

crowbar MCP server. Agent Mart. https://agentmart.dev/connectors/kushvinth-crowbar (last updated 2026-10-24)