Skip to content
Agentmart
Submit a tool

VulnCheck

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

Connector by vulncheck-oss · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 13
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/vulncheck-oss-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

Use cases: security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
29 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
None found
Runs as
Docker image

Tools by what they do 29

Read from the source code; the running server may list different tools.

Read 29 · Look things up without changing anything.

  • describe_index
  • get_backup
  • get_cpe_cves
  • get_doc
  • get_rules
  • identify_component
  • list_backups
  • list_c2_hostnames
  • list_c2_tags
  • list_indices
  • list_recent_advisories
  • search_canaries
Show 17 more tools
  • search_cpe
  • search_curated_exploits
  • search_cve
  • search_docs
  • search_index
  • search_ip_intel
  • search_nvd_cpe_match
  • search_nvd_cpes
  • search_nvd_cve_history
  • search_nvd_cves
  • search_nvd_sources
  • search_purls
  • search_target_intel
  • v4_get_advisory_backup
  • v4_list_advisories
  • v4_list_advisory_backups
  • v4_search_advisory

Network hosts it talks to 5

  • api.vulncheck.com · found in code
  • docs.vulncheck.com · found in code
  • example.test · found in code
  • github.com · found in code
  • serve.vulncheck.com · found in code

Tools (29)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • describe_indexDescribe Index

    Report which filters an index accepts and the values each one takes, how large it is, and which tool to use for it. Call this before search_index against an unfamiliar index: indices accept different filters, and one an index does not support has no effect rather than raising an error, so a query can appear to filter when it does not. Filters and their accepted values are read from the index itself, so they reflect what it currently supports rather than what is documented.

  • get_backupGet Backup

    Return all backup links for a given index.

  • get_cpe_cvesGet CPE CVEs

    Return all CVE IDs associated with a CPE 2.3 string. Optionally restrict to CVEs where the CPE is confirmed vulnerable. Any attribute accepts '*' and '?' wildcards, so a trailing wildcard on the product covers every product sharing that prefix in one call — prefer this over search_cpe when exploring a vendor: search_cpe returns at most 100 CPEs per call with no way to page to the rest, and its response can still reach tens of megabytes because each CPE carries its full CVE list. Wildcarding both vendor and product is unbounded and should be avoided.

  • get_docGet Doc

    Fetch the raw markdown content of a VulnCheck documentation page. Use search_docs first to discover available page URLs.

  • get_rulesGet Rules

    Retrieve initial-access detection rules by type. Supported types: 'suricata', 'snort'. Accepts an optional 'cve' parameter to filter rules to those containing a specific CVE ID.

  • identify_componentIdentify Component

    Convert a vendor, product, and optional version into best-match CPE and PURL identifiers with confidence levels.

  • list_backupsList Backups

    List all VulnCheck index backups. Call this first to discover which index names can be passed to get_backup. Accepts an optional 'search' parameter to filter results by name or description.

  • list_c2_hostnamesList C2 Hostnames

    Retrieve the list of VulnCheck C2 hostnames. Useful for identifying command-and-control infrastructure in protective DNS services and denylists. Accepts an optional 'search' parameter to look up a specific hostname.

  • list_c2_tagsList C2 Tags

    Retrieve the list of VulnCheck C2 IP addresses. Useful for identifying command-and-control infrastructure in block lists or firewall rules. Accepts an optional 'search' parameter to look up a specific IP address.

  • list_indicesList Indices

    List VulnCheck index names. Call this first to discover which index names exist. Returns names only unless a search narrows the set, since the full catalogue is large; descriptions can be requested explicitly. Use describe_index to find out which filters an index accepts and which tool to query it with.

  • list_recent_advisoriesList Recent Advisories

    Summarise which advisories were published or updated over a time window — the answer to "what changed recently". Returns a compact digest of identity, provenance and timing rather than full advisory records, so a page of results costs a fraction of the underlying data. Defaults to the last 24 hours. Optionally restrict to one feed, or filter by vendor or product. Follow up with v4_search_advisory and a cve_id for any record in full.

  • search_canariesSearch Canary Intelligence

    Find exploitation attempts observed against VulnCheck's own globally deployed vulnerable canary hosts. Because the canary is a genuinely vulnerable system, a hit is direct evidence a CVE is being attacked in the wild, not an inference — it answers "is this being exploited right now, and by whom". Filter by CVE, date, source or destination country, source IP, source ASN or CIDR. Pick the window with the window argument rather than naming an index; use 'all' for the full history. A response is a sample of the matching events and total reports how many there are.

  • search_cpeSearch CPE

    Search for CPEs by component fields (vendor, product, version, part) and return matching CPEs with their associated CVEs. vulnerable_only narrows the CVEs listed against each CPE, not the CPEs returned; there is no filter here for "only vulnerable components".

  • search_curated_exploitsSearch Curated Exploits

    Search VulnCheck's curated exploit intelligence by how good the exploit is and how thoroughly it was validated, not merely whether one exists. Answers "which vulnerabilities have weaponized exploit code", "what has VulnCheck's own exploit developers reviewed", and "what is in the VulnCheck KEV catalogue but not CISA's". Each row is one CVE with its exploit entries, maturity, validation verdicts, KEV status, EPSS score and timeline. Combine with a date range to see what exploit intelligence changed recently.

  • search_cveSearch CVE

    Search all VulnCheck indices for a CVE ID. Returns matching records aggregated across advisories, exploits, threat intelligence, and vulnerability databases. Supports cursor-based pagination.

Show 14 more tools
  • search_docsSearch Docs

    Search the VulnCheck documentation and return the pages that match, ranked by relevance. Returns titles, descriptions and URLs — pass a URL to get_doc for the page itself. Searches all sections by default, except translations of the primary content. Call without a query to list the sections.

  • search_indexSearch Index

    Query a VulnCheck index by name (required). Use list_indices to discover available index names. Filter by CVE, alias, IAVA, JVNDB ID, threat actor, MITRE ATT&CK group, MISP ID, ransomware group, botnet, and date ranges. Supports sorting and cursor-based pagination. Indices accept different filters, and one an index does not support is ignored rather than rejected: the response is unfiltered, with no error and a total that looks right. Call describe_index first for an unfamiliar index — it reports which filters that index actually accepts and the values each one takes. For IP Intelligence, Targ…

  • search_ip_intelSearch IP Intelligence

    Find attacker and target IP infrastructure observed over a rolling window: command-and-control servers, honeypots, and hosts potentially targeted by initial-access exploits, with geolocation and ASN enrichment. Filter by CVE, detection type, ASN, CIDR, country, hostname, threat actor, botnet or ransomware group. Pick the window with the window argument rather than naming an index. A response is a sample of the matching population and total reports its true size.

  • search_nvd_cpe_matchSearch NVD CPE Match Criteria

    Description is built at runtime.

  • search_nvd_cpesSearch NVD CPE Dictionary

    Description is built at runtime.

  • search_nvd_cve_historySearch NVD CVE History

    Description is built at runtime.

  • search_nvd_cvesSearch NVD CVEs

    Description is built at runtime.

  • search_nvd_sourcesSearch NVD Sources

    Description is built at runtime.

  • search_purlsSearch Package URLs

    Return vulnerability findings for one or more Package URLs (PURLs). Each result includes associated CVEs and vulnerability details.

  • search_target_intelSearch Target Intelligence

    Find internet-facing hosts confirmed to be running vulnerable software, mapped to CVEs by version-level fingerprinting. Answers "which hosts are exposed to this CVE right now", and locates infrastructure by classification — C2, scanners, proxies, honeypots. Filter by CVE, CPE, vendor, product, version, ASN, CIDR, country, port or classification. This index is far larger than any single response, so a result is a sample of the matching population and total reports its true size.

  • v4_get_advisory_backupGet Advisory Backup

    Return pre-signed download URLs for a VulnCheck v4 advisory feed backup.

  • v4_list_advisoriesList Advisories

    List all available VulnCheck advisory feeds. Call this first to discover which advisory names can be passed to v4_search_advisory.

  • v4_list_advisory_backupsList Advisory Backups

    List all VulnCheck v4 advisory backup feeds and their availability. Call this first to discover which feed names can be passed to v4_get_advisory_backup.

  • v4_search_advisorySearch Advisory

    Search VulnCheck v4 advisory feeds. Filter by advisory name, CVE ID, vendor, product, version, CPE, PURL, and more. This is the tool that finds advisories carrying no CPE data, such as GHSA records for npm, PyPI and Go software — prefer it over the CPE tools for package-ecosystem products. Vendor and product are matched exactly and case-sensitively against the CNA-published strings; alternative capitalisations are retried automatically and an unmatchable product filter is dropped, with both explained in notes.

Compare and alternatives

    Featured in

    Signals

    Stars
    13
    Forks
    1
    Open issues
    0
    Last commit
    Oct 13, 2026 (15 days ago)
    Last release
    Oct 13, 2026 (15 days ago)

    From GitHub (fetched Oct 24, 2026).

    Details

    Registry name
    io.github.vulncheck-oss/mcp
    Version
    0.2.3
    Auth
    No auth
    Packages
    oci ghcr.io/vulncheck-oss/mcp:0.2.3
    License
    MIT
    Repository
    github.com/vulncheck-oss/mcp
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    VulnCheck MCP server. Agent Mart. https://agentmart.dev/connectors/vulncheck-oss-mcp (last updated 2026-10-24)