Documentation

Feeds

https://vulnwire.hypernurb.dev/feed returns RSS by default; add format=atom or format=json (JSON Feed 1.1). Each feed holds the 50 newest matching entries.

filter

critical or kev. Critical means: in CISA KEV, or CISA SSVC exploitation active, or CVSS 9+ in alisted technology, or CVSS 7+ with EPSS ≥ 0.1. A KEV-only feed is ordered by the date CISA added the entry.

tech

A technology slug from the list below.

ecosystem

npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget

vendor

A vendor or product name, matched as a substring of the CNA, CISA and NVD vendor/product names, e.g.vendor=fortinet or vendor=exchange server. One value; 2–60 characters.

Combining: each field takes a comma list or repeats. An entry must match any value of a field and every field given. At most 16 combinations per feed (the product of the value counts).

Every filter combination on the front page shows its feed URL. For your own dependencies, useCheck your stack or https://vulnwire.hypernurb.dev/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0.

JSON API

All endpoints send Access-Control-Allow-Origin: *. Errors are {"error": "…"} with a 4xx status.

GET /api/v1/entries/<id>

One entry. Aliases redirect (301) to the canonical id; follow redirects.

GET /api/v1/entries

filter, tech, ecosystem as for feeds, plus limit (1–200) andcursor. Newest first; pass next_cursor back as cursor.

GET /api/v1/search

q, severity, kev, exploited, tech,ecosystem, vendor, package, published, type(cve|ghsa|osv), limit, offset. Results carrymatched reasons and facet counts; when nothing matches, broader suggests relaxed queries.published: 2024, 2024-05, 2024-01-01..2024-03-31,>=2024-01-01, <2024-01-01 or 30d.

POST /api/v1/stack

JSON {"filename": "package-lock.json", "content": "…"} or{"packages": "npm:lodash@4.17.20,pypi:django@4.2.0"}, or a multipart upload in alockfile field (5 MB max). Returns findings, a report URL and an RSS feed URL.

GET /api/v1/stack/<id>

A stored report.

GET /stack?p=…

RSS (or format=atom|json) of entries affecting exactly those versions. Nothing is stored.

GET /api/v1/status

Source sync health and counts.

curl -sL https://vulnwire.hypernurb.dev/api/v1/entries/CVE-2021-44228
curl -s 'https://vulnwire.hypernurb.dev/api/v1/search?q=log4j&kev=1'
curl -s -F lockfile=@package-lock.json https://vulnwire.hypernurb.dev/api/v1/stack

Supported lockfiles: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, Gemfile.lock, composer.lock, mix.lock, packages.lock.json, gradle.lockfile.

MCP server

Streamable HTTP, stateless, no authentication.

Tools

search

Search vulnwire entries (CVE, GHSA and OSV advisories merged into one entry per vulnerability). Free text in `q` matches ids, titles, descriptions, vendors, products and package names; structured parameters narrow the result. Each result says why it matched; when nothing matches, `broader` lists relaxed queries that do return results.

get_vulnerability

Full entry for a CVE, GHSA or OSV id: description, CVSS, CISA KEV status and due date, EPSS score and the date it first reached 10%, public exploits, affected packages with fixed versions, affected products, references and source records.

list_feed

Newest entries of a feed, the same as https://vulnwire.hypernurb.dev/feed. `filter`: critical = in CISA KEV, or CISA SSVC exploitation "active", or CVSS 9+ in a listed technology, or CVSS 7+ with EPSS ≥ 0.1; kev = in CISA KEV (ordered by date added). An entry must match any value of a field and every field given.

check_stack

Check exact package versions for known vulnerabilities. Pass a lockfile's contents (package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, Gemfile.lock, composer.lock, mix.lock, packages.lock.json, gradle.lockfile) with its filename, or a package list. No matches means none were found, not that the packages are safe.

Claude Code

claude mcp add --transport http vulnwire https://vulnwire.hypernurb.dev/mcp

Codex

codex mcp add vulnwire --url https://vulnwire.hypernurb.dev/mcp

Cursor

In .cursor/mcp.json:

{
  "mcpServers": {
    "vulnwire": {
      "url": "https://vulnwire.hypernurb.dev/mcp"
    }
  }
}

AGENTS.md snippet

Paste this into your project's AGENTS.md or CLAUDE.md:

## Dependencies and vulnerabilities

Use the vulnwire MCP server (https://vulnwire.hypernurb.dev/mcp, no auth) or https://vulnwire.hypernurb.dev/llms.txt.

- Before adding or upgrading a dependency, call check_stack with the lockfile contents (or packages at exact versions).
- For any CVE, GHSA or OSV id, call get_vulnerability: it says whether the entry is in CISA KEV, its EPSS score and when it first reached 10%, public exploits and fixed versions.
- No matches means vulnwire found none, not that the packages are safe.

Copy snippet

The same facts, in plain text, live at /llms.txt.

Merge rules

• One entry per vulnerability. Records that name each other as aliases are merged.
• The entry id is the CVE id when there is one (CVE wins), then the GHSA id, then the record's own id (PYSEC-, GO-, RUSTSEC-…).
• Two different CVEs never merge, even when an advisory lists both.
• Every other id redirects to the entry: /GHSA-… leads to the CVE it belongs to.
• KEV, EPSS and Exploit-DB attach by CVE id.

Technologies

An entry is filed under a technology through its CPEs, its CNA vendor/product strings or its affected packages. Matchers are deliberately narrow.