API and MCP

Everything on cve.now is free to read by machine: no key, no account. An optional cve.now API key gives your own rate limit instead of the shared one.

MCP

Add the MCP server

Streamable HTTP, no auth. Your agent can look up any CVE, read feeds, search the catalog and check a project's dependencies.

Set up the cve.now MCP server for me. cve.now is a free, public vulnerability feed: no login, no API key.

- Server name: cve-now
- Transport: Streamable HTTP
- URL: https://mcp.cve.now/mcp

Add it the way you normally add MCP servers (your CLI command or your MCP config file), then confirm it connects and lists its tools: get_vulnerability, list_feed and check_stack. To finish, use get_vulnerability to look up one recent CVE and summarize it for me.

Paste this into any coding agent. It adds the server with its own MCP setup.

get_vulnerability: Get one vulnerability entry by CVE, GHSA or OSV id, as JSON
list_feed: List the newest items in a cve.now feed
check_stack: Check exact package versions against cve.now's synced vulnerability catalog
send_feedback: Send a private note to the cve.now team
get_leaderboard: Get the cve.now Index
search: Search cve.now's whole catalog of vulnerabilities and early warnings

REST

REST API

Every MCP tool has a REST twin that takes the same inputs and returns the same JSON.

OpenAPI

Get vulnerability: GET /api/v1/entries/<id>
List feed: GET /api/v1/entries?name=<feed> (or tech, ecosystem, limit)
Check dependencies: POST /api/v1/check
Send feedback: POST /api/v1/feedback
Get leaderboard: GET /api/v1/leaderboard
Search vulnerabilities: GET /api/v1/search
Every entry, newest first: GET /api/v1/entries
Upload a lockfile for check_stack or a stack feed: POST /api/stack
Sync and coverage status: GET /api/v1/status
Public usage counts: GET /api/stats

curl -L https://cve.now/api/v1/entries/CVE-2021-44228

Feeds

RSS by default, or Atom and JSON Feed. Narrow by filter (critical, kev), technology or package ecosystem, or build a feed of only what affects your lockfile.

https://cve.now/feed?filter=critical&format=json

https://cve.now/feed?tech=nextjs,react

Docs

Docs for agents

Entry, day and browse pages also have a Markdown copy: add .md to the URL, or send Accept: text/markdown.

llms.txt · llms-full.txt · openapi.json · agent.json · mcp.json · Agent skill

Something wrong or missing? Use the send_feedback tool, POST /api/v1/feedback, or the form on the About page.