VulnCheck — Claude Code MCP server: CVE and exploit lookup
Wires your AI assistant into VulnCheck vulnerability data, so you can ask about CVEs, exploits and risky packages without leaving the editor.
claude mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3What VulnCheck does
The VulnCheck MCP server hands your assistant vulnerability intelligence. Ask about a CVE and you get the details, severity, exploitability signals and which versions are affected. Package checks run by CPE or PURL, right where you're working.
There's also advisory search across vendors and ecosystems, plus queries against VulnCheck indices for breach, botnet and threat context. Handy during triage or code review: a dependency with a known hole shows up before it ships.
You need a VulnCheck API token. Without it the server has nothing to query. It ships as a binary for macOS, Linux and Windows or as the Docker image ghcr.io/vulncheck-oss/mcp, and the install commands use the image.
What it helps with
- pull CVE details and affected versions while triaging a bug
- check a package by CPE or PURL before a release
- find out whether a CVE has exploit code or active exploitation
- look up vendor advisories by package or product name
- query breach and botnet indices for incident context
Example prompts for the agent
- Look up CVE-2024-3094 in VulnCheck and tell me if there's exploit code
- Check
lodashby PURL for known vulnerabilities - Search advisories for nginx from the past year
How to install VulnCheck
Platform CLI
claude mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3Platform CLI
codex mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3Config file
{
"mcpServers": {
"vulncheck": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/vulncheck-oss/mcp:0.2.3"
]
}
}
}Config file
{
"servers": {
"vulncheck": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/vulncheck-oss/mcp:0.2.3"
]
}
}
}Platform CLI
gemini mcp add vulncheck docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about VulnCheck
How do I install VulnCheck in Claude Code?
Run claude mcp add vulncheck -- docker run -i --rm ghcr.io/vulncheck-oss/mcp:0.2.3. Docker needs to be running.
What does the VulnCheck MCP server do?
It connects your AI assistant to VulnCheck vulnerability data: CVE lookup, exploit intelligence, advisories, vulnerable packages and threat indices.
What do I need before it works?
A VulnCheck API token, created in the VulnCheck console, and Docker if you install from the image.
