> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# cve.now

> Give the Sazabi agent tools to look up CVE, GHSA, and OSV vulnerabilities, browse cve.now feeds, and check a project's dependencies against known vulnerabilities. On by default in every project.

[All cve.now integration capabilities](https://docs.sazabi.com/catalogs/integrations/cve-now)

## About

This is an MCP connector that gives the Sazabi agent tools from cve.now's hosted MCP server (`mcp.cve.now/mcp`). cve.now publishes a public vulnerability feed, and the server exposes three read-only tools: `get_vulnerability` (look up one entry by CVE, GHSA, or OSV id), `list_feed` (list the newest items in a feed such as `critical`, `kev`, `ecosystem/<ecosystem>`, or `package/<ecosystem>/<name>`), and `check_stack` (list vulnerabilities affecting exact package versions from a lockfile or a package list). The server needs no authentication.

cve.now is on by default in every project. Sazabi adds it automatically, so there is nothing to connect, no credentials to enter, and no per-project setup. It is managed by Sazabi: it cannot be renamed or disconnected.

**What the agent can do:**

* Look up a vulnerability by CVE, GHSA, or OSV id
* Browse the newest critical, known-exploited, per-technology, per-ecosystem, and per-package vulnerability feeds
* Check a project's lockfile or package list against known vulnerabilities

**What `check_stack` shares and covers:** `check_stack` sends the lockfile contents to cve.now, which does not log them. It matches exact versions against every advisory in the catalog that has affected-version data, so an empty result means none were found, not that a package is safe. For a specific CVE, the agent looks it up with `get_vulnerability`.

## Prerequisites

* None. cve.now is on by default in every project and its MCP server is public.

## Set up in the dashboard

There is nothing to set up. Find cve.now in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors), where it appears as connected and managed by Sazabi.

## Set up with the CLI

There is nothing to set up with the CLI either. With the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) installed and authenticated (see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)), list the project's connectors to see cve.now:

```bash theme={"system"}
sazabi mcp-connectors list
```

## Verify

Open [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm cve.now is listed as connected and managed by Sazabi. Then, in a thread, ask the agent what a specific CVE is, for example "what is CVE-2026-112005?", and confirm it returns that entry's title, severity, and affected versions.

## Troubleshooting

**cve.now is not listed** — Sazabi can turn the default off for every project at once if the cve.now server has problems. Check back later or contact Sazabi support.

**`check_stack` returns no vulnerabilities** — Only advisories with affected-version data in a supported ecosystem can match. Ask the agent to look up a specific CVE with `get_vulnerability`. See [Check your stack](https://docs.sazabi.com/cve-now/check-your-stack.md#what-a-check-covers).

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.