---
name: cve-now
description: Look up a CVE, check a project's dependencies for known vulnerabilities, and follow new critical or KEV vulnerabilities, using cve.now.
---

# cve.now

Use when a user asks about a CVE, GHSA or OSV id, whether their dependencies have known vulnerabilities, what is being exploited now, or how to follow new vulnerabilities for a technology.

1. Prefer the MCP server at https://mcp.cve.now/mcp (Streamable HTTP, no auth). Without MCP, use REST (no key, same JSON):
   - GET https://cve.now/api/v1/entries/<id>: Get vulnerability (MCP tool `get_vulnerability`, same JSON)
   - GET https://cve.now/api/v1/entries?name=<feed> (or tech, ecosystem, limit): List feed (MCP tool `list_feed`, same JSON)
   - POST https://cve.now/api/v1/check: Check dependencies (MCP tool `check_stack`, same JSON)
   - POST https://cve.now/api/v1/feedback: Send feedback (MCP tool `send_feedback`, same JSON)
   - GET https://cve.now/api/v1/leaderboard: Get leaderboard (MCP tool `get_leaderboard`, same JSON)
   - GET https://cve.now/api/v1/search: Search vulnerabilities (MCP tool `search`, same JSON)
2. One vulnerability: `get_vulnerability` (GET https://cve.now/api/v1/entries/<id>; follow redirects). Quote its severity, KEV status and fixedIn, and link https://cve.now/<id>.
3. A project's dependencies: `check_stack` with the lockfile, a package list, or the stack_id of a lockfile uploaded with `curl --data-binary @<file> -H 'X-Lockfile-Name: <file name>' https://cve.now/api/stack`. No matches means none found, not a guarantee of safety.
4. Finding entries by words or fields: `search`. An empty answer is not evidence that no vulnerability exists; read its suggestions.
5. To follow new vulnerabilities, give the user a feed URL: https://cve.now/feed?filter=critical (RSS; add &format=json, or tech=<slug>, ecosystem=<eco>, filter=kev).
6. Wrong or missing data: `send_feedback` (POST https://cve.now/api/v1/feedback) with the entry id in page.