# Access to cve.new

## Public access
No account, registration, API key, OAuth token, or payment is required for the public catalog, feeds, exact dependency checks, or MCP server.

- [API documentation](https://cve.new/docs)
- [OpenAPI description](https://cve.new/openapi.json)
- [Agent guide](https://cve.new/llms.txt)
- MCP endpoint: https://cve.new/mcp (Streamable HTTP)

Send requests directly. Do not ask the user for credentials or attempt an OAuth registration flow. cve.new does not operate an OAuth authorization server or issue access tokens. This document describes access; it does not advertise support for the Auth.md registration protocol.

## Private dependency reports
Reports use secret capability URLs, not user accounts. Anyone with a report URL can read that report. A separate management key is required to delete it. Treat both as secrets: never publish them in discovery documents, citations, logs, or shared caches. Reports expire after 30 days. See [privacy and retention](https://cve.new/privacy) and [report documentation](https://cve.new/docs#reports).

## Request limits and data sharing
An HTTP 429 response means the request was rate limited, not that authentication is required. Wait for the Retry-After interval before retrying. An HTTP 503 may mean checks are temporarily paused.

Exact dependency checks send package names and versions to OSV. Only submit dependency information the user has authorized sharing. The public exact-version endpoint and MCP check_stack tool do not create a stored report.