Scan your dependencies

Upload a lockfile. We flag dependencies with CVEs that are exploited in the wild, have public exploit code, or that your WAF vendor covers.

What we've seen

Built for agents

Let your agent do it

Connect to the Vigilbase CVE MCP server (https://cve.vigilbase.com/mcp, streamable HTTP, no key needed) and use it for vulnerability triage:
1. Scan my lockfiles with scan_dependencies and list the vulnerable packages, exploited-in-the-wild CVEs first, then ones with public exploit code.
2. For each of those CVEs, call get_cve_coverage: tell me whether my WAF vendor claims a rule, whether it blocks by default, and what Vigilbase's own lab test measured.
3. Run check_exposure for my domain on the top CVEs.
4. Give me a prioritised fix list with the fixed versions, and cite the source URLs the server returns.

claude mcp add --transport http vigilbase-cve https://cve.vigilbase.com/mcp

{
  "mcpServers": {
    "vigilbase-cve": {
      "url": "https://cve.vigilbase.com/mcp"
    }
  }
}

# ~/.codex/config.toml
[mcp_servers.vigilbase-cve]
url = "https://cve.vigilbase.com/mcp"

https://cve.vigilbase.com/mcp

From CI or a script

curl -F file=@package-lock.json \
  https://cve.vigilbase.com/api/v1/scan