cve.now

All cve.now integration capabilities

About

This is an MCP connector that gives the Sazabi agent tools from cve.now's hosted MCP server (mcp.cve.now/mcp). cve.now publishes a public vulnerability feed, and the server exposes three read-only tools: get_vulnerability (look up one entry by CVE, GHSA, or OSV id), list_feed (list the newest items in a feed such as critical, kev, ecosystem/<ecosystem>, or package/<ecosystem>/<name>), and check_stack (list vulnerabilities affecting exact package versions from a lockfile or a package list). The server needs no authentication.

cve.now is on by default in every project. Sazabi adds it automatically, so there is nothing to connect, no credentials to enter, and no per-project setup. It is managed by Sazabi: it cannot be renamed or disconnected.

What the agent can do:

• Look up a vulnerability by CVE, GHSA, or OSV id
• Browse the newest critical, known-exploited, per-technology, per-ecosystem, and per-package vulnerability feeds
• Check a project's lockfile or package list against recent vulnerabilities

What check_stack shares and covers: check_stack sends the lockfile contents to cve.now, which does not log them. It covers vulnerabilities from the last 90 days only, so an empty result does not mean a package is unaffected by older vulnerabilities. For those, the agent looks up the specific CVE with get_vulnerability or the package's feed with list_feed.

Prerequisites

• None. cve.now is on by default in every project and its MCP server is public.

Set up in the dashboard

There is nothing to set up. Find cve.now in Settings > MCP connectors, where it appears as connected and managed by Sazabi.

Set up with the CLI

There is nothing to set up with the CLI either. With the Sazabi CLI installed and authenticated (see sazabi mcp-connectors reference), list the project's connectors to see cve.now:

sazabi mcp-connectors list

Verify

Open Settings > MCP connectors and confirm cve.now is listed as connected and managed by Sazabi. Then, in a thread, ask the agent what a specific CVE is, for example "what is CVE-2026-112005?", and confirm it returns that entry's title, severity, and affected versions.

Troubleshooting

cve.now is not listed — Sazabi can turn the default off for every project at once if the cve.now server has problems. Check back later or contact Sazabi support.

check_stack returns no vulnerabilities — It only covers the last 90 days. Ask the agent to check specific CVEs or a package's feed for older vulnerabilities.

Further reading