VulnFeed
Scan dependencies for CVEs with EPSS prioritization through nine MCP tools, using the free tier or a paid license key.
Overview
io.github.infai-tech/vulnfeed is a MCP server for the Ship phase that provides 9 dependency vulnerability tools with EPSS scoring via stdio PyPI.
What is this MCP server?
- 9 MCP tools for dependency vulnerability scanning with EPSS scoring
- PyPI package vulnfeed-mcp (version 0.3.3) with stdio transport
- Free tier works without VULNFEED_API_KEY; optional Polar.sh license for paid tier
- x402 payment model mentioned for extended commercial use
- Focused on supply-chain risk, not penetration testing exploitation
- 9 MCP tools documented in catalog description
- Server version 0.3.3 on PyPI identifier vulnfeed-mcp
- Free tier available without API key; optional VULNFEED_API_KEY for paid tier
What problem does it solve?
Dependency CVE noise piles up in lockfiles and solo builders lack a fast, agent-friendly way to prioritize what to fix before shipping.
Who is it for?
Indie developers who want free-tier MCP vulnerability scanning with optional paid license for heavier EPSS-backed workflows.
Skip if: Organizations that need on-prem-only scanning with no external API, or teams seeking active exploit pentesting rather than dependency intelligence.
What do I get? / Deliverables
After registering vulnfeed-mcp, your agent can run EPSS-aware vulnerability scans so you patch the highest-risk packages with a clearer order of operations.
- Stdio VulnFeed MCP server connected to your agent
- EPSS-informed vulnerability findings on project dependencies
- Repeatable pre-ship and post-update security scan workflow
Recommended MCP Servers
Journey fit
How it compares
Dependency CVE and EPSS scanner MCP, not a Razorpay billing connector or CPU profiler.
Common Questions / FAQ
Who is io.github.infai-tech/vulnfeed for?
Solo builders and small teams shipping npm, Python, or mixed stacks who want coding agents to run dependency vulnerability checks with EPSS prioritization.
When should I use io.github.infai-tech/vulnfeed?
Use it in ship security before releases, when dependencies update, or in operate when monitoring for newly disclosed CVEs affecting your lockfile.
How do I add io.github.infai-tech/vulnfeed to my agent?
Install vulnfeed-mcp from PyPI, configure stdio in your MCP client, optionally set VULNFEED_API_KEY for paid tier, then enable the server and run its 9 tools from your agent.