SIGN UPLOG IN
X (Twitter)LinkedInGitHubDiscordYouTube

How to connect cve.now MCP to Claude

Connect Claude Web, Desktop and Cowork to cve.now MCP. Check lodash 4.17.20 for known vulnerabilities, look up cve-2024-3094 and summarize impact, and more using natural language, with authentication handled for you.

Get started for freeGet a demo
cve.now MCP logocve.now MCP
No Auth

cve.now is a free public vulnerability feed and lookup service for CVEs, GHSAs, OSVs, and package versions. It provides fast, exact vulnerability checks against an indexed catalog without requiring authentication.

3 Tools

Introduction

Claude is Anthropic's AI assistant, available on the web, in the desktop app, and on mobile. Cowork is its agent for knowledge work, and it runs on all of those surfaces too. Connected to your apps, Claude can work with your files and services to accomplish complex tasks on your behalf.

This guide walks you through the easiest and most secure way to connect your cve.now account to Claude via Composio Connect, enabling it to check lodash 4.17.20 for known vulnerabilities, look up CVE-2024-3094 and summarize impact, find recent vulnerabilities affecting your package version, and more such actions on your behalf without compromising your account security.

Setup is the same on Claude Web, Desktop, and Cowork, and you only need to do it once. The connector is tied to your account, so it's available in all three.

Also integrate cve.now MCP with

ChatGPTHermesAtomic Agent

Connecting cve.now to Claude Web, Desktop, and Cowork

Two ways to add the Composio connector. Pick whichever you prefer.

1. Add with one click

Click the button. Claude opens with the Composio connector filled in. Click Add, then go to step 2.

Add to Claude

Add manually

In Claude Desktop, click Customize in the left sidebar, then select Connectors and click the + icon at the top.

Claude Desktop connectors screen with Add custom connector selected

Click Add custom connector and paste in the Composio MCP server URL:

bash
https://connect.composio.dev/mcp
Add custom connector dialog with Composio MCP server URL

2. Authorize in your browser

Click Connect. You'll be redirected to a browser window where you can authorize Composio to continue.

Composio authorization screen for Claude Web, Desktop, and Cowork

3. Connect your cve.now account

Back in Claude, ask it to connect to cve.now or give it any cve.now-related task.

For example, ask Claude to:

  • "Check lodash 4.17.20 for known vulnerabilities"
  • "Look up CVE-2024-3094 and summarize impact"
  • "Find recent vulnerabilities affecting your package version"

It will prompt you to authenticate and authorize access.

That's it. Composio's tools are now available in Claude, and your cve.now account is ready to use.

What is the cve.now Claude Connector, and what's possible with it?

The cve.now MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to cve.now. It provides structured and secure access to vulnerability feeds, vulnerability records, and package-version checks, so your agent can check dependencies, look up CVE, GHSA, and OSV entries, review the newest feed items, and find vulnerabilities affecting a specific package version on your behalf.

  • Dependency vulnerability checks: Have your agent check a lockfile or package list against cve.now's indexed catalog and identify matching vulnerabilities for exact package versions.
  • Vulnerability lookups: Direct your agent to retrieve a vulnerability entry by its CVE, GHSA, or OSV reference.
  • Latest vulnerability feeds: Let the agent review new items from the critical, all, or KEV feeds to help track recently published risks.
  • Technology and ecosystem monitoring: Instruct your agent to list feed items for a specific technology or package ecosystem.
  • Responsible result interpretation: Have your agent explain that no catalog matches do not guarantee safety and distinguish model-written summaries from upstream vulnerability data.

Troubleshooting

1. Why does Claude not use the Composio connector for cve.now?

The connector can show as connected, but Claude must use it in each cve.now conversation.

  • Click + at the lower left of the chat, or type /.
  • Hover Connectors.
  • Turn on Composio.
  • Ask Claude to connect to cve.now again.

2. Why does Claude show an MCP server error before cve.now connects?

Claude can show Couldn't reach the MCP server or Authorization with the MCP server failed when you add the connector for cve.now.

  • Check that the connector URL is https://connect.composio.dev/mcp.
  • Connectors run from Anthropic's cloud, so your device network is usually not the problem.
  • Add the connector again from Customize > Connectors, then ask Claude to connect cve.now.
  • If it fails again, send the error and the ofid_ reference id to support@composio.dev.

3. Why does the cve.now authorization link not work?

The Composio connector is one server. Your cve.now account connects separately when Claude asks for it.

  • If the browser does not open, or the link expires, ask Claude to retry the cve.now connection.
  • Composio creates a fresh cve.now authorization link.
  • Open that link in your browser and finish the cve.now sign-in.

4. Why do cve.now actions fail after they worked before?

The cve.now connection can expire or lose permission.

  • Ask Claude to inspect the cve.now connection.
  • If the connection is unhealthy, disconnect it when Claude prompts you.
  • Reconnect the cve.now account and retry the action.
  • If Claude shows a permission prompt, approve it before Claude changes data in cve.now.
  • If the action still fails with a permission error, check that the connected account has that permission in cve.now itself.

5. How do I switch to a different cve.now account?

Claude can manage the cve.now connection for you.

  • Ask Claude to disconnect or delete the current cve.now account.
  • Ask Claude to connect cve.now again.
  • Open the new Composio authorization link for cve.now.
  • Sign in with the other cve.now account in the browser.
  • After the account connects, ask Claude to retry the cve.now task.

6. Why is my cve.now connection missing in Claude Desktop or on a Team plan?

The connector belongs to your Claude account, so your cve.now connection works in Claude Web, Desktop, and Cowork.

  • In Claude Desktop, open Customize > Connectors.
  • Next to Composio, click ⋮ and click Clear cache.
  • If cve.now tools still do not appear, click ⋮, disconnect, remove the connector, and add it again.
  • On Team or Enterprise, an Owner or Primary Owner must enable the connector before you can connect cve.now.
TOOLS

Supported Tools

Every cve.now MCP action and event your agent gets out of the box.

Check stack

Check exact package versions against cve.

Get vulnerability

Get one vulnerability entry by CVE, GHSA or OSV id, as JSON.

List feed

List the newest items in a cve.

FRAMEWORKS

How to build cve.now MCP Agent with another framework

ChatGPT logo

ChatGPT

Use cve.now MCP with ChatGPT

Hermes logo

Hermes

Use cve.now MCP with Hermes

Atomic Agent logo

Atomic Agent

Use cve.now MCP with Atomic Agent

FAQ

Frequently asked questions

With a standalone cve.now MCP server, the agents and LLMs can only access a fixed set of cve.now tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from cve.now and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Claude Cowork fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right cve.now tools.

Yes, absolutely. You can configure which cve.now scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your cve.now data and credentials are handled as safely as possible.

Start with cve.now MCP.It takes 30 seconds.

Managed auth, hosted MCP servers, and every cve.now MCP tool your agent needs.Free to start.

Start building