# cve.now MCP

```json
{
  "name": "cve.now MCP",
  "slug": "cve_now_mcp",
  "url": "https://composio.dev/toolkits/cve_now_mcp",
  "markdown_url": "https://composio.dev/toolkits/cve_now_mcp.md",
  "logo_url": "https://logos.composio.dev/api/cve_now_mcp",
  "categories": [
    "developer tools & devops"
  ],
  "is_composio_managed": false,
  "updated_at": "2026-10-24T05:31:45.652Z"
}
```

![cve.now MCP logo](https://logos.composio.dev/api/cve_now_mcp)

## Description

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with cve.now MCP or direct API to search vulnerability feeds, look up CVEs, check package versions, and summarize security findings through natural language.

## Summary

cve.now is a free public vulnerability feed and lookup service for CVEs, GHSAs, OSVs, and package versions.
It provides fast, exact vulnerability checks against an indexed catalog without requiring authentication.

## Categories

- developer tools & devops

## Toolkit Details

- Tools: 3

## Images

- Logo: https://logos.composio.dev/api/cve_now_mcp

## Authentication

- **No Auth**
  - Type: `custom`
  - Description: No Auth authentication for cve.now MCP.
  - Setup:
    - Configure No Auth credentials for cve.now MCP.
    - Use the credentials when creating an auth config in Composio.

## Suggested Prompts

- Check lodash 4.17.20 for known vulnerabilities
- Look up CVE-2024-3094 and summarize impact
- Find recent vulnerabilities affecting my package version

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `CVE_NOW_MCP_CHECK_STACK` | Check stack | Check exact package versions against cve.now's synced vulnerability catalog using a lockfile or package list. Inputs are sent to cve.now; avoid including secrets or private dependency details without authorization. No matches means none in this catalog, not a guarantee of safety. |
| `CVE_NOW_MCP_GET_VULNERABILITY` | Get vulnerability | Get one vulnerability entry by CVE, GHSA or OSV id, as JSON. |
| `CVE_NOW_MCP_LIST_FEED` | List feed | List the newest items in a cve.now feed (critical, all, kev, tech/, ecosystem/). |

## Supported Triggers

None listed.

## Installation and MCP Setup

### Path 1: SDK Installation

#### Path 1, Step 1: Install Composio

Install the Composio SDK, the OpenAI provider, and the OpenAI SDK
```python
pip install composio composio_openai openai
```

```typescript
npm install @composio/core @composio/openai openai
```

#### Path 1, Step 2: Create a Composio session

Initialize Composio with the OpenAI Responses provider and create a session scoped to cve.now MCP
```python
import json
from openai import OpenAI
from composio import Composio
from composio_openai import OpenAIResponsesProvider

composio = Composio(provider=OpenAIResponsesProvider())
client = OpenAI()

session = composio.create(user_id="your-user-id", toolkits=["cve_now_mcp"])
tools = session.tools()
```

```typescript
import OpenAI from "openai";
import { Composio } from "@composio/core";
import { OpenAIResponsesProvider } from "@composio/openai";

const composio = new Composio({ provider: new OpenAIResponsesProvider() });
const client = new OpenAI();

const session = await composio.create("your-user-id", { toolkits: ["cve_now_mcp"] });
const tools = await session.tools();
```

#### Path 1, Step 3: Run cve.now MCP tools with your agent

Send a request, execute the cve.now MCP tool calls through the session, and print the final answer
```python
response = client.responses.create(
    model="gpt-5.6-sol",
    tools=tools,
    input=[{"role": "user", "content": "Check package version lodash 4.17.20 for known vulnerabilities and summarize the results."}],
)

while True:
    tool_calls = [o for o in response.output if o.type == "function_call"]
    if not tool_calls:
        break
    results = composio.provider.handle_tool_calls(response=response, session=session)
    response = client.responses.create(
        model="gpt-5.6-sol",
        tools=tools,
        previous_response_id=response.id,
        input=[
            {"type": "function_call_output", "call_id": call.call_id, "output": json.dumps(results[i])}
            for i, call in enumerate(tool_calls)
        ],
    )

print(response.output_text)
```

```typescript
let response = await client.responses.create({
  model: "gpt-5.6-sol",
  tools,
  input: [{ role: "user", content: "Check package version lodash 4.17.20 for known vulnerabilities and summarize the results." }],
});

while (response.output.some((o) => o.type === "function_call")) {
  const outputs = await composio.provider.handleToolCalls(session, response.output);
  response = await client.responses.create({
    model: "gpt-5.6-sol",
    tools,
    previous_response_id: response.id,
    input: outputs,
  });
}

console.log(response.output_text);
```

### Path 2: MCP Server Setup

#### Path 2, Step 1: Install Composio

Install the Composio SDK and your agent framework
```python
pip install composio claude-agent-sdk
```

```typescript
npm install @composio/core ai @ai-sdk/mcp @ai-sdk/openai
```

#### Path 2, Step 2: Create a session with MCP enabled

Create a session scoped to cve.now MCP and read its MCP URL and headers
```python
from composio import Composio

composio = Composio()
session = composio.create(user_id="your-user-id", toolkits=["cve_now_mcp"], mcp=True)
```

```typescript
import { Composio } from "@composio/core";

const composio = new Composio();
const { mcp } = await composio.create("your-user-id", {
  toolkits: ["cve_now_mcp"],
  mcp: true,
});
```

#### Path 2, Step 3: Connect your agent to the MCP server

Pass the session's MCP URL and headers to your agent and run a cve.now MCP request
```python
import asyncio
from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions, AssistantMessage, TextBlock

options = ClaudeAgentOptions(
    mcp_servers={
        "composio": {
            "type": "http",
            "url": session.mcp.url,
            "headers": session.mcp.headers,
        }
    },
    system_prompt="You are a helpful assistant with access to cve.now MCP tools.",
    tools=[],
    allowed_tools=["mcp__composio__*"],
)

async def main():
    async with ClaudeSDKClient(options=options) as client:
        await client.query("Check package version lodash 4.17.20 for known vulnerabilities and summarize the results.")
        async for message in client.receive_response():
            if isinstance(message, AssistantMessage):
                for block in message.content:
                    if isinstance(block, TextBlock):
                        print(block.text)

asyncio.run(main())
```

```typescript
import { createMCPClient } from "@ai-sdk/mcp";
import { openai } from "@ai-sdk/openai";
import { generateText, stepCountIs } from "ai";

const client = await createMCPClient({
  transport: { type: "http", url: mcp.url, headers: mcp.headers },
});

const { text } = await generateText({
  model: openai("gpt-5.6-sol"),
  tools: await client.tools(),
  prompt: "Check package version lodash 4.17.20 for known vulnerabilities and summarize the results.",
  stopWhen: stepCountIs(10),
});

console.log(text);
await client.close();
```

## Why Use Composio?

### 1. AI Native cve.now MCP Integration

- Supports both cve.now MCP and direct API based integrations
- Structured, LLM-friendly schemas for reliable vulnerability lookups
- Query CVE, GHSA, OSV, feed, and exact package-version data without writing bespoke integration code

### 2. No Credential Setup

- cve.now is publicly available and requires no API keys or OAuth setup
- Composio creates the session and exposes the selected cve.now tools to your agent
- Keep your application focused on security workflows instead of connection plumbing

### 3. Agent Optimized Design

- Tools are tuned using real error and success rates to improve reliability over time
- Agents can turn structured vulnerability results into clear, actionable summaries
- Comprehensive execution logs show what ran, when, and on whose behalf

### 4. Enterprise Grade Security

- Fine-grained RBAC helps control which agents and users can access cve.now MCP
- Scoped tool access supports least-privilege security review workflows
- Full audit trails help teams review automated vulnerability checks and findings

## Use cve.now MCP with any AI Agent Framework

Choose a framework you want to connect cve.now MCP with:

- [ChatGPT](https://composio.dev/toolkits/cve_now_mcp/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/cve_now_mcp/framework/claude-cowork)
- [Hermes](https://composio.dev/toolkits/cve_now_mcp/framework/hermes-agent)
- [Atomic Agent](https://composio.dev/toolkits/cve_now_mcp/framework/atomic-agent)

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [GitHub](https://composio.dev/toolkits/github) - GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anakin](https://composio.dev/toolkits/anakin_io) - Anakin is a web automation platform offering scraping, crawling, search, and browser automation. Use it to extract structured data, automate site tasks, and monitor web changes reliably.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [Authyo](https://composio.dev/toolkits/authyo) - Authyo is a REST API service for passwordless authentication, OTP verification, session management, and transactional notifications. Use it to add secure login flows and user verification without building auth infrastructure from scratch.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Azure Monitor Activity Log](https://composio.dev/toolkits/azure_monitor_activity_log) - Azure Monitor Activity Log is Azure's service that records management and control-plane events for a subscription. Use it to audit changes, troubleshoot issues, and track resource operations across your Azure resources.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.
- [Baserow](https://composio.dev/toolkits/baserow) - Baserow is an open-source no-code database platform for building collaborative data apps. It makes it easy for teams to organize data and automate workflows without writing code.

## Frequently Asked Questions

### Do I need my own developer credentials to use cve.now MCP with Composio?

No, cve.now MCP requires no developer credentials or authentication. Composio handles the session setup and secure tool access for you.

### Can I use multiple toolkits together?

Yes! Composio's Tool Router enables agents to use multiple toolkits. [Learn more](https://docs.composio.dev/tool-router/overview).

### Is Composio secure?

Composio is SOC 2 and ISO 27001 compliant with all data encrypted in transit and at rest. [Learn more](https://trust.composio.dev).

### What if the API changes?

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)