New: every message picks a fast or a slow model

cve.now MCP

cve.now by Sazabi provides a free public vulnerability feed, CVE/GHSA/OSV lookups, and exact package-version checks against its indexed catalog. No authentication required. No matches do not guarantee safety; model-written summaries are labeled and published under CC-BY 4.0, while upstream data retains its own licensing and attribution.

What agents can do

Actions3

  • Check stack

    Check exact package versions against cve.now's synced vulnerability catalog using a lockfile or package list.

  • Get vulnerability

    Get one vulnerability entry by CVE, GHSA or OSV id, as JSON.

  • List feed

    List the newest items in a cve.now feed (critical, all, kev, tech/<slug>, ecosystem/<eco>).

How it connects

Nothing to connect: agents can use it straight away.

Keep the connection to yourself or share it with your workspace. Any action that writes or sends can wait for your approval.