How to integrate cve.now MCP with Atomic Agent

Connect Atomic Agent to cve.now MCP. Check lodash 4.17.20 for known vulnerabilities, look up cve-2024-3094 and summarize impact, and more using natural language, with authentication handled for you.

cve.now MCP logocve.now MCP
No Auth

cve.now is a free public vulnerability feed and lookup service for CVEs, GHSAs, OSVs, and package versions. It provides fast, exact vulnerability checks against an indexed catalog without requiring authentication.

3 Tools

Introduction

Atomic Agent is an open-source AI agent that runs on your machine and supports local models through llama.cpp. Connect it to 1,500+ apps through Composio, including cve.now.

This guide uses Atomic Agent's built-in Composio integration. You need Atomic Agent v0.5.6 or later, your own Composio API key, and a cve.now account. See the Atomic Agent documentation for installation instructions.

Also integrate cve.now MCP with

How Atomic Agent connects to cve.now

Atomic Agent connects to Composio's Tool Router over Streamable HTTP MCP. It discovers the tools needed for your request, and Composio handles account authentication.

Execution and account-connection tools follow Atomic Agent's configured approval policy. Review any approval prompt before allowing an action on your connected account.

Connect cve.now to Atomic Agent

  1. Sign up or sign in to the Composio dashboard. Copy your API key.
  2. In Atomic Agent, open the Integrations tab and select Composio. Select API key, press e, paste the key, and press Enter. The tools become available immediately, without a restart.
  3. Ask Atomic Agent to do something in cve.now. It searches Composio for the right tool.
  4. On first use, open the sign-in link returned in the chat. Connect your cve.now account, then return to Atomic Agent to continue.

Headless setup

Add the following line to ~/.atomic-agent/.env, replacing YOUR_COMPOSIO_API_KEY with your key. Start Atomic Agent after saving the file.

bash
COMPOSIO_API_KEY=YOUR_COMPOSIO_API_KEY

What is the cve.now MCP server, and what's possible with it?

The cve.now MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to cve.now. It provides structured and secure access to vulnerability feeds, vulnerability records, and package-version checks, so your agent can check dependencies, look up CVE, GHSA, and OSV entries, review the newest feed items, and find vulnerabilities affecting a specific package version on your behalf.

  • Dependency vulnerability checks: Have your agent check a lockfile or package list against cve.now's indexed catalog and identify matching vulnerabilities for exact package versions.
  • Vulnerability lookups: Direct your agent to retrieve a vulnerability entry by its CVE, GHSA, or OSV reference.
  • Latest vulnerability feeds: Let the agent review new items from the critical, all, or KEV feeds to help track recently published risks.
  • Technology and ecosystem monitoring: Instruct your agent to list feed items for a specific technology or package ecosystem.
  • Responsible result interpretation: Have your agent explain that no catalog matches do not guarantee safety and distinguish model-written summaries from upstream vulnerability data.

Use cve.now from Atomic Agent

With your account connected, ask Atomic Agent to work with cve.now in natural language. You can connect more apps through the same Composio integration as you need them.

Visit the Atomic Agent website or inspect the Atomic Agent source code.

Troubleshooting

Why is my API key rejected?

Copy the key directly from the Composio dashboard. Atomic Agent requires ASCII characters because it sends the key in an HTTP header. Remove any extra characters introduced when copying.

Why are Composio tools unavailable after saving a key?

Check that you use Atomic Agent v0.5.6 or later and that Composio is enabled in your configuration. A "composio": { "enabled": false } setting disables the integration while keeping the saved key on disk.

Does Composio have a free plan?

The Hobby plan includes 100,000 tool calls per month. Composio-managed OAuth apps have a lower included allowance. See Composio pricing for the current limits that apply to your connection.

TOOLS

Supported Tools

Every cve.now MCP action and event your agent gets out of the box.

Check stack

Check exact package versions against cve.

Get vulnerability

Get one vulnerability entry by CVE, GHSA or OSV id, as JSON.

List feed

List the newest items in a cve.

FAQ

Frequently asked questions

With a standalone cve.now MCP server, the agents and LLMs can only access a fixed set of cve.now tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from cve.now and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Atomic Agent fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right cve.now tools.

Yes, absolutely. You can configure which cve.now scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your cve.now data and credentials are handled as safely as possible.

Start with cve.now MCP.It takes 30 seconds.

Managed auth, hosted MCP servers, and every cve.now MCP tool your agent needs.Free to start.

Start building