A confident answer and a correct answer look identical
Ask any coding agent about a CVE and you get an answer shaped by training data, frozen at some point in the past, with no knowledge of exploitation, deadlines or available fixes. The failure is invisible: the model answers with exactly the same confidence either way, and nothing in the response tells you which kind you got. The alternative is not a better guess, it is a lookup: in CISA KEV since 10 Dec, due 24 Dec, known ransomware use, EPSS 0.99999, SSVC says Act, last seen in the wild two days ago, fixed in 2.17.0.
One URL, and your agent stops guessing
The entire integration is https://mcp.vulnetix.com/mcp and one Authorization header. No daemon, no container, no shim, nothing to keep current. Protocol revision 2026-07-28 removed sessions from MCP entirely, so the server holds nothing between requests: nothing on your machine to install, and nothing on ours to leak between tenants.
Claude Code
Claude Desktop
Cursor
VS Code / Copilot
Windsurf
Zed
Cline
Roo Code
Goose
Continue
JetBrains AI
Codex CLI
31 tools, shaped around the question rather than the endpoint
Is this vulnerability real?
CISA KEV membership with the binding due date, EPSS probability, SSVC decision, exploitation maturity and dated in-the-wild sightings. Four independent signals instead of one severity label.
Is it being exploited?
Per-source exploit counts across ExploitDB, Metasploit, Nuclei, VulnCheck XDB, CrowdSec, GitHub, HackerOne and 13 more, plus first and last observation dates, so history is distinguishable from right now.
Should I add this dependency?
Vulnerability count, max severity, exploitation signals, end-of-life status, OpenSSF Scorecard and a recommended safe version across npm, PyPI, Go, crates.io, RubyGems, Maven, Packagist and NuGet.
What exactly do I change?
Ranked remediation actions with concrete steps, distribution patches, registry fixes and workarounds, plus the manifest edit, install command, verification command and rollback.
Can I detect it before I can patch it?
Deployable Snort and Suricata signatures, YARA rules and Nuclei templates, returned whole, because a summary of a rule cannot be deployed.
Who is behind it?
Indicators of compromise, threat-actor attribution, MITRE ATT&CK technique chains and the lifecycle timeline showing how fast this class of issue historically gets weaponised.
Any MCP server can wrap a CVE API. Six of these tools have no CVE to wrap.
This is not a claim about anyone's roadmap, it is a claim about data. A server built over an advisory feed answers advisory questions well, and end-of-life, malware, detection content, project health and ATT&CK mapping are not advisories. Each tool below names the record type behind it, so you can ask for the record and check the answer. The VDB aggregates 150+ upstream sources, enumerable through the public /v1/sources endpoint, across 4.8M advisory records and 173M affected-version rows.
vulnetix_eol_products
End-of-life products and releases with support dates. Nothing issues a CVE when support ends, so an advisory-only tool reports an abandoned runtime as clean.
vulnetix_detection_rules
Snort and Suricata signatures, YARA rules and Nuclei templates returned whole. Detection content is normally a separate product from a vulnerability feed.
vulnetix_scorecard
OpenSSF Scorecard per check, plus maintainer records, provenance and attestations, so a dependency decision rests on how the project is run as well as on its open advisories.
vulnetix_iocs
Indicators of compromise, dated in-the-wild sightings and threat-actor attribution joined to the advisory the agent asked about.
vulnetix_attack_techniques
MITRE ATT&CK techniques, detections and mitigations mapped per advisory, so a coverage-gap question can start from the vulnerability.
vulnetix_typosquat_check
Malicious packages with evidence and indicators, plus typosquat candidates. A malicious package rarely has a CVE at all.
2.6 MB is not an answer
A raw database record for Log4Shell is 2,606,571 bytes, roughly 650,000 tokens. No context window holds it and no useful answer needs it. Every response is reduced on the server before it reaches your model: the decision fields survive verbatim (KEV due date, SSVC, EPSS, exploitation maturity, remediation timeline, the routines to grep for) while 676 affected packages become a count and a grouping with a pointer to where the rest can be paged. The default view is 10,613 bytes, 0.41% of the raw record, and every result reports its own ratio so the reduction is visible rather than assumed. The shaping layer is held to byte-for-byte parity with the filters the Vulnetix Claude Code plugin runs in production, by a differential test that found three real bugs in the originals, since fixed upstream.
33 workflows, and 16 of them never touch our servers
Tools answer a question; prompts run the procedure. The complete Pix skill library ships as MCP prompts, delivered verbatim from source with CI failing the build if the two ever drift. Seventeen run with nothing installed: CVE triage, exploit intelligence, dependency gating, typosquat detection, KEV watching, SOC triage, threat digests, ATT&CK mapping, IOC pivots, detection rules, secure-coding coaching and a full incident-response playbook. Sixteen drive your own machine: SAST, secret scanning, IaC and container analysis, SBOM generation, licence checks, applying a fix, resolving a blocked upgrade, verifying it landed and publishing VEX.
No source code leaves your machine
There is no tool that accepts file content, because there is nothing on the other side that could use it. What crosses the wire is a package name, a version, or an advisory identifier. That boundary is why the sixteen workflows that need a repository run locally instead of here: it is the guarantee, not a gap waiting to be filled. The server is stateless by protocol design, with no sessions, no per-user storage and no database, and your credential is forwarded to the API and never interpreted.
Free to start, on every plan
All 31 tools and all 33 workflows work on the free Community plan, using your own key and the same quota that applies anywhere else. What a paid plan buys is depth: Community sees exploit and IOC counts, Pro and above see the individual records and unlock the AI analysis layer. Where a plan withholds detail the counts are still returned and the tool says so explicitly, so an empty list never silently means "none found".
Frequently asked
What do I have to install?
Nothing. The server is remote and stateless: one HTTPS URL plus an Authorization header in your client's MCP config. There is no daemon, no container, no npx shim and no version to keep current. Protocol revision 2026-07-28 removed sessions from MCP, so the server holds nothing between requests.
Which MCP clients work?
Twelve are verified against the live endpoint: Claude Code, Claude Desktop, Cursor, VS Code and Copilot, Windsurf, Zed, Cline, Roo Code, Goose, Continue, JetBrains AI and Codex CLI. Any client that can add a remote HTTP MCP server with a custom header works, because there is nothing Vulnetix-specific to support. Each client spells its config differently, so every tutorial names the trap: Windsurf wants serverUrl where everyone else wants url, Goose wants uri, and VS Code wants servers rather than mcpServers.
Does my source code get uploaded?
No. There is no tool that accepts file content, because there is nothing on the other side that could use it. What crosses the wire is a package name, a version or an advisory identifier. Sixteen of the thirty-three workflows need a repository, and those run on your machine through your own agent and the Vulnetix CLI rather than here.
How does it fit in a context window?
A raw database record for Log4Shell is 2,606,571 bytes, roughly 650,000 tokens. Every response is reduced on the server first: decision fields survive verbatim (KEV due date, SSVC, EPSS, exploitation maturity, remediation timeline, affected routines) while enumerations become counts, groupings and a pointer to where the rest can be paged. The default view is 10,613 bytes, and every result reports its own reduction ratio so nothing is assumed.
What does it cost?
All 31 tools and all 33 workflows work on the free Community plan. What a paid plan buys is depth: Community sees exploit and IOC counts, Pro and above see the individual records. Where a plan withholds detail the counts are still returned and the tool says so explicitly in the response, so an empty list never silently means "none found".
How is this different from an MCP server over a CVE API?
Six of the tools have no CVE to wrap. End-of-life lifecycle data, malicious package records, deployable detection content, OpenSSF Scorecard and provenance, MITRE ATT&CK mapping and per-advisory reachability queries are separate record types, not advisories. The VDB aggregates 150+ upstream sources, enumerable through the public /v1/sources endpoint, across 4.8M advisory records and 173M affected-version rows.