# vulnerable.now

> Free CVE lookups, package checks and patch priorities from public sources. No account or API key.

- name: now.vulnerable/mcp
- version: 0.4.0
- connection class: R0 (autonomous)
- trust: 82/100 flags: no-repository
- quality: 89/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/now.vulnerable%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/now.vulnerable%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "vulnerable": {
      "type": "http",
      "url": "https://vulnerable.now/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 98
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-94% +updated-3d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,989 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 3 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 2,989 tokens to load them all
- tool set hash: 70750a89a2a382f153d0f5b2daa333cb
- tools last changed: 2026-11-14T05:55:40.001Z
- badge: [![protogrid quality](https://protogrid.dev/badge/now.vulnerable/mcp.svg)](https://protogrid.dev/servers/now.vulnerable/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-14 `get_overview` added
  - Get the stored AI-written overview of one CVE: one paragraph on what the flaw is, what it affects, what an attacker can do, whether it is exploited and how to fix it, written by Hinoki Offensive One from the entry's source data. Overviews are written only when someone opens the CVE page on vulnerable.now, so this tool reads and never writes one. status says whether the paragraph is ready, stale (the sources changed since), missing or still being written. AI text can be wrong; check get_vulnerability and the sources. The same JSON as GET /api/v1/entries/{id}/overview.
- 2026-11-11 `get_poc` added
  - List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.
- 2026-11-10 `list_feed` changed (inputSchema)
- 2026-11-10 `search` changed (description, inputSchema)
  - before: Search the whole catalog by words: product, vendor, package, CVE ID or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.
  - after: Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.

Full history: https://api.protogrid.dev/v1/servers/now.vulnerable%2Fmcp/changes

## Remotes

- https://vulnerable.now/mcp (streamable-http, auth none, reachable true, uptime30d 0.9375)

## Packages

_none_

## Tools (9)

- `check_stack`: Find known vulnerabilities in what a project or site runs, ranked by what to fix first. Send exact package versions, the raw content of a lockfile (package-lock.json, poetry.lock, go.sum and others), a CycloneDX or SPDX SBOM, a Wappalyzer export, or detected technologies such as nginx 1.18.0. Returns each finding with severity, exploitation, priority and fixed versions.
- `get_overview`: Get the stored AI-written overview of one CVE: one paragraph on what the flaw is, what it affects, what an attacker can do, whether it is exploited and how to fix it, written by Hinoki Offensive One from the entry's source data. Overviews are written only when someone opens the CVE page on vulnerable.now, so this tool reads and never writes one. status says whether the paragraph is ready, stale (the sources changed since), missing or still being written. AI text can be wrong; check get_vulnerability and the sources. The same JSON as GET /api/v1/entries/{id}/overview.
- `get_package`: Every known vulnerability in one open source package, most urgent first, with the affected ranges and fixed versions published for that package. Give a version to learn which advisories affect it and the lowest upgrade that leaves every affecting range.
- `get_poc`: List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.
- `get_product`: Every known vulnerability in one vendor product, such as an operating system, browser, server, CMS or appliance, most urgent first, with the affected versions and fixes. The vendor is optional: with only a product name, a clear match is answered directly and otherwise the candidates are listed. Give a version to learn which entries affect it and the lowest upgrade that clears them.
- `get_vulnerability`: Get the merged entry for one or more IDs: CVE, GitHub advisory (GHSA), EUVD, or an OSV ID such as PYSEC, GO or RUSTSEC. Returns the description, CVSS, CISA KEV status, EPSS, public exploits, affected packages, fixed versions, priority and source links.
- `list_feed`: List vulnerabilities newest first (KEV listings by date added when kev is set). Filter by severity, CISA KEV, exploitation, public exploit code, fix availability, ecosystem, vendor, product, text and dates. Use modified_since to pick up changes since a previous run.
- `search`: Search the whole catalog by words: product, vendor, package, CVE ID, common vulnerability name, research metadata or description text. Best match first by default. Each result says which fields matched. When nothing matches, the reply suggests a broader query.
- `top_priority`: What to patch first: the vulnerabilities with the highest priority score (exploitation, EPSS, CVSS, automatability) among those with activity in a time window, optionally narrowed to an ecosystem, vendor or product.