What one command wires
Wire Windsurf to Vulnetix. Skills install to ~/.codeium/windsurf/skills, and the MCP server gives Cascade live vulnerability data.
vulnetix agent install --agent windsurf- Agent Skills: supported —
~/.codeium/windsurf/skills - Dependency guard: not wired by the installer —
hook contract not yet verified - MCP server: supported —
https://mcp.vulnetix.com/mcp
Where Windsurf reads skills
Agent Skills is an open standard, but hosts disagree about the directory. The installer writes the one Windsurf actually opens.
- Everywhere, for you:
~/.codeium/windsurf/skills - This repository:
.windsurf/skills
Add the MCP server
{
"mcpServers": {
"vulnetix": {
"serverUrl": "https://mcp.vulnetix.com/mcp",
"headers": { "Authorization": "ApiKey <orgId>:<key>" }
}
}
}Ask something training data cannot answer
No install and no local binary: one URL and one header give the agent live vulnerability intelligence it can call mid-conversation.
>
is CVE-2021-44228 still actively exploited?
→ calling vulnetix_vuln
org.apache.logging.log4j:log4j-core@2.14.1 · maven
17 vulnerabilities · 11 critical, 4 high
- CVE-2021-44228 critical · CVSS 10.0 · EPSS 100.0%
- CVE-2021-45046 critical · CVSS 9.2 · EPSS 100.0%
- CVE-2021-44832 critical · CVSS 9.3 · EPSS 97.9%
CISA KEV · due 2021-12-24 · known ransomware use