# cve.now

> A free, public vulnerability feed. It merges the CVE List, GitHub Advisory Database, OSV, NVD, ENISA EUVD, CISA KEV, EPSS and Exploit-DB into one deduplicated entry per vulnerability. Summaries are written by a model and labeled as such. No login, no API key.

## Feeds

One feed URL, /feed, narrowed with filters that combine freely. RSS by default; add format=atom or format=json.

- /feed: every entry
- /feed?filter=critical: KEV, CERT-rated critical, or CVSS 9+ in widely used software
- /feed?filter=kev: new CISA Known Exploited Vulnerabilities
- /feed?tech=<slug>: one technology, for example /feed?tech=php
- /feed?ecosystem=<eco>: one package ecosystem (npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget)
- Combined: /feed?filter=critical&tech=nextjs&format=json

## Entries

- /<id>: human-readable page for a CVE, GHSA or OSV id
- /api/v1/entries/<id>: the same entry as JSON
- /api/v1/entries: all published entries, newest first, with an opaque nextCursor
- /api/v1/status: latest polling checks and the independently verified historical snapshot coverage

Historical CVEs come from a complete official cvelistV5 snapshot. New deltas and
record edits overlay that snapshot. Snapshot coverage does not include vendor
announcements whose CVE records have not been published yet. Package matching
requires supported ecosystem and affected-version data; CVE presence alone does
not establish complete package matching coverage.

## MCP

Streamable HTTP MCP server for coding agents: https://cve.now/mcp

Paste into any coding agent to set it up:

Add the cve.now MCP server to your MCP configuration: name "cve-now", remote Streamable HTTP server at https://cve.now/mcp, no authentication. Then confirm the tools get_vulnerability, list_feed and check_stack are available, and run check_stack on this project's lockfile to list any known vulnerabilities in my dependencies.

## Stack feed

/stack builds a feed of only the entries that affect your exact package versions.
Upload a lockfile from the homepage to get a short /stack?s=<id> feed URL.
Uploads are retained in private storage for analytics and feed generation. Anyone with a feed URL can view its vulnerability matches; original files are not served publicly.
For small package lists, /stack?p=npm:lodash@4.17.20 remains available. Add format=json for JSON.

## Licensing

Summaries are CC-BY 4.0. Uses NVD data; not endorsed by NVD.