crowbar — Claude Code MCP server: a local CVE index for your repo
Pulls vulnerability data for a product and version into a local SQLite index, so your agent answers CVE questions without hitting the network.
claude mcp add crowbar -- uvx crowbar-cliWhat crowbar does
crowbar gathers records from NVD, CISA KEV, EPSS, SSVC, the CVE List, Exploit-DB, Nuclei, Metasploit, OSV and more, then writes them into one SQLite database with FTS5 full-text search. You or your agent ask about a product and version, and the answer comes from that local index. No network call, so the same query returns the same result every time and lookups take milliseconds.
Two ways to use it. Over MCP the agent calls tools such as cb_cve, cb_product, cb_search and cb_exploit on its own when a vulnerability question comes up. There is also a plain CLI: crowbar sync --tier lite, crowbar build --tier lite, crowbar doctor. The lite, medium, heavy and extreme tiers differ in how much data lands on disk, and each one includes the tier above it. The CLI needs Python 3.11+ and no third-party Python packages.
The index lives in ~/.crowbar. The lite tier takes about 150 MB, and the first build is slow because NVD downloads crawl. Refresh with crowbar update. Public exploits and PoCs are stored as data: crowbar never clones or runs them. Treat anything it surfaces as hostile code, detonate it only in a disposable VM, and point it at systems you own or are allowed to test.
What it helps with
- find which CVEs affect a specific product version
- judge real-world exploitability from KEV, EPSS and SSVC
- locate working PoCs and exploits for a CVE you just found
- build a local vulnerability index with no API keys or rate limits
- give an agent offline CVE access from the terminal or CI
Example prompts for the agent
- Check whether nginx 1.18.0 is vulnerable and which of its CVEs are actually exploited
- Find working PoCs for CVE-2021-44228 in the local crowbar index
- Build the lite vulnerability index and verify it is ready
How to install crowbar
Platform CLI
claude mcp add crowbar -- uvx crowbar-cliuvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>
Platform CLI
codex mcp add crowbar -- uvx crowbar-cliuvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>
Config file
{
"mcpServers": {
"crowbar": {
"command": "uvx",
"args": [
"crowbar-cli"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>
Config file
{
"servers": {
"crowbar": {
"type": "stdio",
"command": "uvx",
"args": [
"crowbar-cli"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>
Platform CLI
gemini mcp add crowbar uvx crowbar-cliuvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about crowbar
How do I install crowbar in Claude Code?
Run claude mcp add crowbar -- uvx crowbar-cli. The server starts on demand through uvx, so there is no heavy install step.
What does crowbar do?
It collects vulnerability data from public feeds into a local SQLite + FTS5 database. Your agent or the CLI queries it by product and version and gets the KEV/SSVC/EPSS/CVSS verdict along with affected version ranges and PoC links.
What does crowbar need to run?
The CLI requires Python 3.11+ and no third-party Python packages. The index sits in ~/.crowbar, and the lite tier takes roughly 150 MB.
