Official description7 sourcesMCP servers8d ago

infai-tech/vulnfeed-mcp

< mcp-name: io.github.novadyne-hq/vulnfeed VulnFeed — Dependency Vulnerability Monitoring for Claude Code An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

View on GitHub (repository no longer exists)

Source: collected from the punkpeye/awesome-mcp-servers list · type: MCP server
Harvest history: first seen 2026-10-09 · last seen 2026-10-16 · seen 32× · listed by 7 sources
Score: score 703 · 7 sources · mcp

FAQ (answers come from our records)

How do I install it?

We did not find an install command for this repository (our install coverage is only about 4%). Check its README or releases page.

Who is it for?

We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.

Who maintains it?

first catalogued 2026-10-09；last seen 2026-10-16。There is no official certification or quality rating here — we record sources and dates only.

Third-party quality signals

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.
**Free tier** — 10 scans/day, 1 monitored project, no signup required. Single-CVE lookup and webhooks need a license key or x402.
**Homepage:** vulnfeed.novadyne.ai
Install
MCP client config
Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):
**Free tier** (no signup, no API key):
**Paid** ($14/mo, unlimited scans + projects):
Get a license key at vulnfeed.novadyne.ai.
x402 micropayments
VulnFeed also accepts x402 micropayments — AI agents can pay per scan with USDC on Base, no API key or signup needed. When the free tier limit is reached, the API returns HTTP 402 with payment requirements that x402-compatible clients handle automatically.
- $0.01 per scan
- $0.002 per CVE lookup
- $0.50 per project per 30 days of hourly webhook monitoring (renewable; the webhook receives an expiring event with the renew URL a day before)
Tools
Scanning
| Tool | Description |
|------|-------------|
| scan_project | Auto-detect and scan all lockfiles in a directory |
| scan_lockfile | Scan a specific lockfile |
| check_package | Check a single package for vulnerabilities |
| lookup_cve | Detailed CVE info with EPSS + fix versions (license key or x402) |
Monitoring
| Tool | Description |
|------|-------------|
| monitor_project | Register for continuous monitoring (optional webhook_url for push alerts) |
| check_alerts | New vulns since last scan |
| set_webhook | Set, rotate or remove a project's webhook |
| update_deps | Update snapshot after upgrading packages |
| list_monitored | See all monitored projects |
| unmonitor_project | Remove from monitoring |
Supported lockfiles
- package-lock.json (npm)
- yarn.lock (Yarn)
- pnpm-lock.yaml (pnpm)
- requirements.txt (pip)
- Pipfile.lock (Pipenv)
- go.sum / go.mod (Go)
- Cargo.lock (Rust)
- Gemfile.lock (Ruby)
- composer.lock (PHP)
How it works
1. Parses your lockfile to extract dependency names + versions
2. Queries OSV.dev (GitHub Advisories plus each ecosystem's security database) for known CVEs
3. Enriches with EPSS exploit probability scores
4. Filters noise — suppresses low-EPSS, non-critical CVEs by default