com.vulnrable/vulnrable

up checked 2026-11-11T04:39:16.294Z

Unclaimed · Unverified

Publisher-provided description

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Summary by lookupd

Looks up CVE/GHSA details, KEV and EPSS exploitation data, package security grades, and MCP server dependency counts.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http vulnrable https://vulnrable.com/api/mcp

Codex, remote (streamable-http)

codex mcp add vulnrable --url https://vulnrable.com/api/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "vulnrable": {
      "url": "https://vulnrable.com/api/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

check_package Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the
list_mcp_servers The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into
check_cve Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-wor
latest_vulns Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/com.vulnrable/vulnrable.svg)](https://lookupd.com/servers/com.vulnrable/vulnrable)