官方说明7 个来源MCP 服务8 天前

infai-tech/vulnfeed-mcp

< mcp-name: io.github.novadyne-hq/vulnfeed VulnFeed — Dependency Vulnerability Monitoring for Claude Code An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.

在 GitHub（仓库已不存在）

来源明细: 收录自 punkpeye/awesome-mcp-servers 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
收录与活跃: 收录于 2026-10-09 · 最近见到 2026-10-16 · 共见到 32 次 · 被 7 个来源列出
评分构成: 综合分 703 · 7 个来源 · mcp

常见问题（答案都来自我们的记录）

怎么安装？

我们【没有】从该仓库取到安装命令（我们的 install 覆盖率只有约 4%）。请看它的 README 或 releases 页。

它适合谁 / 用来做什么？

我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。

谁维护它、还在更新吗？

我们收录于 2026-10-09；最近见到 2026-10-16。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。

第三方质量标记

VulnFeed — Dependency Vulnerability Monitoring for Claude Code

以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →

An MCP server that scans your project dependencies for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions.
**Free tier** — 10 scans/day, 1 monitored project, no signup required. Single-CVE lookup and webhooks need a license key or x402.
**Homepage:** vulnfeed.novadyne.ai
Install
MCP client config
Add to your MCP client config (~/.claude/settings.json for Claude Code, claude_desktop_config.json for Claude Desktop):
**Free tier** (no signup, no API key):
**Paid** ($14/mo, unlimited scans + projects):
Get a license key at vulnfeed.novadyne.ai.
x402 micropayments
VulnFeed also accepts x402 micropayments — AI agents can pay per scan with USDC on Base, no API key or signup needed. When the free tier limit is reached, the API returns HTTP 402 with payment requirements that x402-compatible clients handle automatically.
- $0.01 per scan
- $0.002 per CVE lookup
- $0.50 per project per 30 days of hourly webhook monitoring (renewable; the webhook receives an expiring event with the renew URL a day before)
Tools
Scanning
| Tool | Description |
|------|-------------|
| scan_project | Auto-detect and scan all lockfiles in a directory |
| scan_lockfile | Scan a specific lockfile |
| check_package | Check a single package for vulnerabilities |
| lookup_cve | Detailed CVE info with EPSS + fix versions (license key or x402) |
Monitoring
| Tool | Description |
|------|-------------|
| monitor_project | Register for continuous monitoring (optional webhook_url for push alerts) |
| check_alerts | New vulns since last scan |
| set_webhook | Set, rotate or remove a project's webhook |
| update_deps | Update snapshot after upgrading packages |
| list_monitored | See all monitored projects |
| unmonitor_project | Remove from monitoring |
Supported lockfiles
- package-lock.json (npm)
- yarn.lock (Yarn)
- pnpm-lock.yaml (pnpm)
- requirements.txt (pip)
- Pipfile.lock (Pipenv)
- go.sum / go.mod (Go)
- Cargo.lock (Rust)
- Gemfile.lock (Ruby)
- composer.lock (PHP)
How it works
1. Parses your lockfile to extract dependency names + versions
2. Queries OSV.dev (GitHub Advisories plus each ecosystem's security database) for known CVEs
3. Enriches with EPSS exploit probability scores
4. Filters noise — suppresses low-EPSS, non-critical CVEs by default