# vulnwire

> A free, public vulnerability feed. vulnwire merges the CVE List, the GitHub Advisory Database, OSV, NVD, CISA's Known Exploited Vulnerabilities catalog (KEV), FIRST EPSS scores and Exploit-DB into one deduplicated entry per vulnerability. No account, no API key.

## MCP server (preferred for agents)

Streamable HTTP, stateless, no auth: https://vulnwire.hypernurb.dev/mcp

Tools: search, get_vulnerability, list_feed, check_stack.

- Before adding or upgrading a dependency, call check_stack with the lockfile contents (or packages at exact versions).
- For any CVE, GHSA or OSV id, call get_vulnerability: it says whether the entry is in CISA KEV, its EPSS score and when it first reached 10%, public exploits and fixed versions.
- No matches means vulnwire found none, not that the packages are safe.

## Feeds

https://vulnwire.hypernurb.dev/feed — RSS by default; format=atom or format=json.
Filters combine: filter=critical|kev, tech=<slug>, ecosystem=<name>, vendor=<vendor or product substring, e.g. fortinet>. Each takes a comma list or repeats; an entry must match any value of a field and every field given; at most 16 combinations.
"critical" = in CISA KEV, or rated "active exploitation" by CISA SSVC, or CVSS 9+ in a listed technology, or CVSS 7+ with EPSS >= 0.1.

Ecosystems: npm, pypi, go, maven, crates.io, packagist, rubygems, hex, nuget
Technologies: nextjs, react, node, express, django, flask, rails, spring, log4j, kubernetes, docker, nginx, apache-httpd, openssl, postgresql, mysql, redis, microsoft-sql-server, oracle-database, mariadb, ibm-db2, mongodb, sap-ase, php, wordpress, jenkins, gitlab, fortinet, citrix, ivanti, cisco-ios, palo-alto-panos, vmware, microsoft-exchange, chrome, linux-kernel

## JSON API (CORS: *)

- GET https://vulnwire.hypernurb.dev/api/v1/entries/<id> — one entry (aliases redirect to the canonical id; follow redirects)
- GET https://vulnwire.hypernurb.dev/api/v1/entries?filter=&tech=&ecosystem=&limit=&cursor= — newest first, paginated by next_cursor
- GET https://vulnwire.hypernurb.dev/api/v1/search?q=&severity=&kev=&exploited=&tech=&ecosystem=&vendor=&package=&published=&type=&limit=&offset= — results carry "matched" reasons; facet counts; "broader" suggests relaxed queries when nothing matches. published: 2024 | 2024-05 | 2024-01-01..2024-03-31 | >=2024-01-01 | <2024-01-01 | 30d
- POST https://vulnwire.hypernurb.dev/api/v1/stack — {"filename":"package-lock.json","content":"..."} or {"packages":"npm:lodash@4.17.20,pypi:django@4.2.0"} → report with findings, a report URL and an RSS feed
- GET https://vulnwire.hypernurb.dev/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0 — RSS of entries affecting exactly those versions
- GET https://vulnwire.hypernurb.dev/api/v1/status — source sync health and counts

## Pages

- https://vulnwire.hypernurb.dev/<id> — entry page for a CVE, GHSA or OSV id
- https://vulnwire.hypernurb.dev/search?q=… — search
- https://vulnwire.hypernurb.dev/check — upload a lockfile