# Vulners MCP

> Vulners MCP is a Model Context Protocol (MCP) server over the Vulners vulnerability API. It gives AI agents and assistants real-time CVE, advisory, exploit, and software / Linux-package audit data from the Vulners corpus, beyond the model training cutoff.

## Endpoint

- MCP endpoint: https://mcp.vulners.com/mcp (Streamable HTTP transport)

## Authentication

This server holds no privileged API key of its own. Send your personal Vulners API key in the `X-Api-Key` HTTP request header for full, uncapped limits; the server forwards it to the Vulners API per request and never stores or issues one on your behalf. Omit the header entirely and the call still goes through, on this deployment's own dedicated, low-privilege anonymous-tier key (when configured) -- reduced limits: result-size arguments clamped to 10, plus a shared, modest rate limit. `initialize` and `tools/list` always work without a key either way. Humans get a key by signing in at https://vulners.com/userinfo in a browser -- an agent fetching that URL directly gets an interactive challenge instead, by design. Full policy: https://mcp.vulners.com/auth.md.

## Tools

- bulletin_by_id: Fetch a vulnerability bulletin by CVE or Vulners ID (single ID or a list of IDs). Returns a COMPACT summary by default (id, title, CVSS3, EPSS, exploitation signal, CVE list); pass `fields=[...]` (e.g. `"description"`) or `references=True` to widen -- requesting everything can be very large.
- search_lucene: Full-text discovery search of the Vulners knowledge base using Lucene syntax.
- audit_software: Audit specific software versions (structured CPE) for known vulnerabilities.
- get_supported_os: List the OS identifiers/versions supported by the Linux package audit.
- audit_linux_packages: Audit Linux packages (RPM/DEB) for a given distribution and version.
- query_autocomplete: Autocomplete suggestions for vendors, products, and CVEs.
- search_cpe: Find CPE strings by vendor and product.

## Links

- Vulners llms.txt: https://vulners.com/llms.txt
- Authentication (this server): https://mcp.vulners.com/auth.md
- Authentication (full registration walk-through): https://vulners.com/auth.md
- MCP server card: https://mcp.vulners.com/.well-known/mcp/server-card.json
- Organization agent index: https://mcp.vulners.com/.well-known/agents/index.json
- API documentation: https://docs.vulners.com/docs/api/
- Source code: https://github.com/vulnersCom/vulners-mcp