GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new

Your agent. Now with CVE context.

Create a vulnerability report from your lockfile.
Check the dependencies you ship, then bring the evidence into your agent workflow.

Drop your lockfile here

or · up to 2 MB

npmpnpmYarnComposerCargoPoetry

We delete your lockfile after parsing and send package names and versions to OSV for checks. Anyone with the report link can view findings. Reports expire after 30 days. Service terms

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Good agent workflows start with original evidence.

CVEOSVGitHubCISA
See source coverage
FROM ADVISORY TO ACTION

Less searching.
More context for your stack.

Find the advisory. Check the version. Give your agent a place to start.

Find what matters.

Filter advisories by severity, ecosystem, and known exploitation. Get the original evidence behind every record.

Explore the catalog

Make it stack-specific.

Drop in a lockfile. Check exact package versions and get a shareable report with a feed for your dependencies.

Check dependencies

Put your agent to work.

Connect through MCP, build on the API, or subscribe to a feed. Bring vulnerability context to the tools you already use.

Connect your tools
YOUR NEXT INVESTIGATION STARTS HERE

Fresh from the catalog.

Explore recently published advisories with links back to the evidence.

View all vulnerabilities
6,888Indexed advisories
705Critical advisories
25Known exploited
Check data freshness
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
CONTEXT FOR YOUR CODING AGENT

Your agent.
Meet your CVE feed.

Give your agent three focused MCP tools to look up advisories, filter the feed, and check exact dependency versions. No account needed.

Connect your agent
mcp.config.json
{
  "mcpServers": {
    "cve-new": {
      "url": "https://cve.new/mcp"
    }
  }
}
get_vulnerabilitylist_feedcheck_stack
BUILD YOUR CVE FEED

Your stack. Your subscription.

Pick your filters. Copy one URL. Connect your reader, agent, or next integration.

https://cve.new/feedOpen
BEFORE YOU CONNECT

Good questions.
Straight answers.

What powers the feed?

CVE records, OSV advisories (including GitHub Advisory Database records), and CISA’s Known Exploited Vulnerabilities catalog. Each entry links to its source. Check source status to see what has been synchronized.

What does “known exploited” mean?

The vulnerability is listed in CISA’s KEV catalog. A published proof of concept alone does not establish exploitation in the wild.

No matches. Does that mean I’m safe?

No. It means the versions successfully checked returned no known vulnerability matches. We show unsupported dependencies and incomplete checks so you can see what still needs attention.

What happens to my lockfile?

The raw upload is deleted after its normalized package inventory is stored. Reports expire after 30 days. Anyone with the report URL can view its findings; only the separate management key can delete it.

READY WHEN YOU ARE

Bring context to your next commit.

Check your stack, follow its advisories, and give your agent the evidence to work with.

Check your dependencies