# crowbar

Pulls vulnerability data for a product and version into a local SQLite index, so your agent answers CVE questions without hitting the network.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: kushvinth
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/kushvinth/crowbar
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/crowbar

## What it does

crowbar gathers records from NVD, CISA KEV, EPSS, SSVC, the CVE List, Exploit-DB, Nuclei, Metasploit, OSV and more, then writes them into one SQLite database with FTS5 full-text search. You or your agent ask about a product and version, and the answer comes from that local index. No network call, so the same query returns the same result every time and lookups take milliseconds.

Two ways to use it. Over MCP the agent calls tools such as `cb_cve`, `cb_product`, `cb_search` and `cb_exploit` on its own when a vulnerability question comes up. There is also a plain CLI: `crowbar sync --tier lite`, `crowbar build --tier lite`, `crowbar doctor`. The `lite`, `medium`, `heavy` and `extreme` tiers differ in how much data lands on disk, and each one includes the tier above it. The CLI needs Python 3.11+ and no third-party Python packages.

The index lives in `~/.crowbar`. The `lite` tier takes about 150 MB, and the first build is slow because NVD downloads crawl. Refresh with `crowbar update`. Public exploits and PoCs are stored as data: crowbar never clones or runs them. Treat anything it surfaces as hostile code, detonate it only in a disposable VM, and point it at systems you own or are allowed to test.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add crowbar -- uvx crowbar-cli
```
uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>

### Codex

**Platform CLI**
```bash
codex mcp add crowbar -- uvx crowbar-cli
```
uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "crowbar": {
            "command": "uvx",
            "args": [
                "crowbar-cli"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "crowbar": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "crowbar-cli"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add crowbar uvx crowbar-cli
```
uvx runs the command named after the package; if the README names another one, use uvx --from crowbar-cli <command>

## When to use it
- find which CVEs affect a specific product version
- judge real-world exploitability from KEV, EPSS and SSVC
- locate working PoCs and exploits for a CVE you just found
- build a local vulnerability index with no API keys or rate limits
- give an agent offline CVE access from the terminal or CI

## Example prompts
- Check whether nginx 1.18.0 is vulnerable and which of its CVEs are actually exploited
- Find working PoCs for CVE-2021-44228 in the local crowbar index
- Build the lite vulnerability index and verify it is ready

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md