What one command wires
Wire Claude Code to Vulnetix: a dependency guard that answers at the moment the agent adds a package, 33 Agent Skills, and 31 MCP tools over a vulnerability database aggregating 150+ sources.
vulnetix agent install --agent claude-code- Agent Skills: supported —
~/.claude/skills - Dependency guard: supported —
~/.claude/settings.json - MCP server: supported —
https://mcp.vulnetix.com/mcp
Where Claude Code reads skills
Agent Skills is an open standard, but hosts disagree about the directory. The installer writes the one Claude Code actually opens.
- Everywhere, for you:
~/.claude/skills - This repository:
.claude/skills
Add the MCP server
claude mcp add --transport http vulnetix https://mcp.vulnetix.com/mcp \
--header "Authorization: ApiKey $VULNETIX_ORG:$VULNETIX_KEY"True of Claude Code specifically
- The hook contract was measured against Claude Code 2.1.260, not read from documentation: additionalContext reaches the model, systemMessage does not.
- The plugin also installs from the marketplace with /plugin install vulnetix@vulnetix-plugins.
Install lodash at a version with known critical advisories
The guard refuses the tool call and gives the agent a reason it can act on. Claude Code stops and explains, in its own words, what it was told.
# wire every agent on this machine, once
$
vulnetix agent install
Claude Code
hooks configured ~/.claude/settings.json
skills ~/.claude/skills
mcp https://mcp.vulnetix.com/mcp
# then ask the agent to add a dependency
>
install lodash 4.17.20
→ npm i lodash@4.17.20
lodash@4.17.20 · npm
12 vulnerabilities · 6 critical, 6 high
- CVE-2021-23337 critical · CVSS 9.3 · EPSS 21.3%
- CVE-2025-13465 critical · CVSS 9.8 · EPSS 1.6%
- CVE-2026-4800 critical · CVSS 9.8 · EPSS 2.8%
- …and 9 more
Exploits: 324 known
Quick fix: bump to 4.17.23
STOPPED. Vulnetix gate block install — lodash@4.17.20
got 12 vuln (6 critical), 324 known exploit.