Connect a coding agent

Add the cve.now MCP server to Claude Code, Cursor, Codex, or any agent that supports remote MCP, so it can look up vulnerabilities, read the feed, and check your lockfile. No login or API key.

cve.now runs a public MCP server at https://cve.now/mcp. It needs no login, OAuth, or API key. Once connected, your agent can look up any vulnerability, read the latest feed, and check the packages in your project against the catalog.

Prerequisites

A coding agent that supports remote MCP servers over Streamable HTTP, such as Claude Code, Cursor, or Codex.

Add the server

Run this in your terminal:

claude mcp add --transport http cve-now https://cve.now/mcp

Add the server to .cursor/mcp.json in your project, then restart Cursor:

{
  "mcpServers": {
    "cve-now": {
      "url": "https://cve.now/mcp"
    }
  }
}

Run this in your terminal. It also configures the Codex editor extension:

codex mcp add cve-now --url https://cve.now/mcp

Add https://cve.now/mcp as a Streamable HTTP MCP server in your agent's settings.

The cve.now homepage also has a copyable prompt that tells your agent to install the server and check your project.

Tools

Tool	What it does	Inputs
`get_vulnerability`	Returns one entry by CVE, GHSA, or OSV id, as JSON. Includes CISA's SSVC decision points when CISA published them.	`id`
`list_feed`	Lists the newest items in a feed.	`name` for one feed (`critical`, `all`, `kev`, `tech/<slug>`, or `ecosystem/<ecosystem>`; `critical` when nothing is passed), or any of `filter`, `tech`, and `ecosystem`; `limit` sets how many items to return, from 1 to 200 (default 20)
`check_stack`	Checks exact package versions against the catalog.	`lockfile_content` (the file's contents, with an optional `lockfile_name`), `packages` (a list of `ecosystem`, `name`, and `version`), or `stack_id`

list_feed's filter, tech, and ecosystem work like the feed parameters: each takes one value or a list, an item must match any listed value of a field and every field passed, and at most 16 combinations are allowed.

check_stack accepts the same lockfiles as an upload, and up to 10,000 packages per call. For a large lockfile, have the agent upload it and pass the returned id as stack_id, so the file's contents do not go through the agent's context:

curl --data-binary @package-lock.json -H 'X-Lockfile-Name: package-lock.json' https://cve.now/api/stack

As with any stack check, no matches means cve.now found none, not that the packages are safe.

Example prompts

"Use cve.now to check this project's lockfile for vulnerabilities, and propose upgrades for anything critical."
"What's on the cve.now critical feed today that affects Next.js or React?"
"Look up CVE-2021-44228 on cve.now. Is it in KEV, and what version fixes it?"

The Sazabi agent

The Sazabi agent has cve.now built in: it is a managed MCP connector that is on by default in every Sazabi project, with nothing to configure. Setup details are on the cve.now connector page.

Verify

Ask the agent to look up CVE-2021-44228 on cve.now. Confirm it calls get_vulnerability and answers with the Log4Shell entry, including that it is in CISA KEV.