Vulners MCP

Vulners MCP Server

Vulners MCP is a Model Context Protocol (MCP) server that provides seamless access to the Vulners vulnerability database through AI assistants like Claude Desktop. It enables security researchers and developers to query comprehensive vulnerability data, search for CVEs, analyze security bulletins, and audit software packages directly through natural language conversations.

Features

• AI Assistant Integration: Works natively with Claude Desktop and other MCP-compatible clients
• Dual Transport Support: Automatically detects and supports both stdio (for Claude Desktop) and HTTP transports
• Comprehensive Tools: 7 MCP tools for vulnerability research including:
• Full-text Lucene search across 4M+ vulnerability bulletins
• CVE and bulletin information retrieval
• Software/package vulnerability auditing
• CPE search and autocomplete
• Linux package vulnerability auditing
• Flexible Deployment: prebuilt Docker image (ghcr.io/vulnerscom/vulners-mcp), PyPI package, or local build
• Environment-based Configuration: Simple setup via environment variables

Table of Contents

• Requirements
• Obtaining Vulners API Key
• Authentication
• Hosted server: mcp.vulners.com
• Quick Start with Claude Desktop
• Installation & Deployment
• PyPI
• Docker with run script
• Docker (manual)
• Build & run locally
• Configuration / Environment Variables
• Usage & Endpoints
• Testing
• Available Tools
• Development & Contributing
• License

---

Requirements

• Python 3.13+ (for PyPI or a local build)
• Access to the Vulners API (valid API key and network connectivity)
• (For Docker) Docker engine

---

Obtaining Vulners API Key

Please, register at Vulners website. Go to the personal menu by clicking at your name at the right top corner. Follow "API KEYS" tab. Generate API key with scope "api" and use it with the library.

---

Authentication

How you provide your API key depends on which transport you run:

Anonymous tier (HTTP only)

initialize and tools/list always work without a key, so an agent can discover what the server offers before it has one. A tools/call sent without an X-Api-Key header behaves according to whether this deployment has an anonymous tier configured:

Example of the guidance error (no key, no anonymous tier configured):

{

"isError": true, "content": [{ "type": "text", "text": "This server does not hold a privileged API key, and no anonymous tier is configured on this deployment. Send your personal Vulners API key in the X-Api-Key HTTP header. Get a key: sign in at https://vulners.com/userinfo (human, in a browser). Details: https://mcp.vulners.com/auth.md (When configured, this server's anonymous tier is itself size- and rate-limited -- your own key always gets full limits.)" }] }

Sending your own X-Api-Key always gets you full, uncapped (at this layer) access -- the anonymous tier exists so an agent can try the server out, or make a light, occasional call, without first obtaining a key.

No env change is required to enable the anonymous tier on a deployment that already sets `VULNERS_API_KEY`. In HTTP mode, VULNERS_MCP_ANON_API_KEY falls back to VULNERS_API_KEY when unset -- so that same key now also backs the (rate-limited, size-clamped) anonymous tier. To back the anonymous tier with a *separate*, dedicated key instead -- so it isn't also your own operator key -- set VULNERS_MCP_ANON_API_KEY explicitly; it always takes precedence over the VULNERS_API_KEY fallback when both are set.

---

Hosted server: mcp.vulners.com

Nothing to install: point any MCP client that speaks Streamable HTTP at

https://mcp.vulners.com/mcp

and send your Vulners API key in the X-Api-Key header (see Obtaining Vulners API Key). For example:

# Claude Code

claude mcp add --transport http vulners https://mcp.vulners.com/mcp \ --header "X-Api-Key: YOUR_API_KEY"

Cursor, in ~/.cursor/mcp.json:

{

"mcpServers": { "vulners": { "url": "https://mcp.vulners.com/mcp", "headers": { "X-Api-Key": "YOUR_API_KEY" } } } }

The same snippets for other clients are on the connection guide at https://mcp.vulners.com/.

---

Quick Start with Claude Desktop

The easiest way to use Vulners MCP is through Claude Desktop:

1. Pull the Docker Image

docker pull ghcr.io/vulnerscom/vulners-mcp:latest

Images are published for linux/amd64 and linux/arm64, tagged latest and with each release version (e.g. 1.15.0). To build it yourself instead, see Building from Source.

2. Configure Claude Desktop

Add to your Claude Desktop configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json Linux: ~/.config/Claude/claude_desktop_config.json

{

"mcpServers": { "vulners": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "VULNERS_API_KEY=YOUR_API_KEY_HERE", "ghcr.io/vulnerscom/vulners-mcp:latest" ] } } }

Replace YOUR_API_KEY_HERE with your actual Vulners API key.

3. Restart Claude Desktop

After saving the configuration, restart Claude Desktop. The Vulners MCP server will be available through the 🔌 icon.

4. Start Using

You can now ask Claude questions like:

• "Find recent vulnerabilities in Google Chrome"
• "Show me details for CVE-2025-53770"
• "What are recent exploted vulnerabilities in Citrix products"
• "Audit this software: cpe:2.3:a:google:chrome:138.0.7204.184:*:*:*:*:*:*:*"
• "Audit ubuntu 22.04 packages 'openssl 3.0.2 amd64' and 'curl 7.81.0-1ubuntu1.14 amd64'"

---

Installation & Deployment

PyPI

# stdio (Claude Desktop and other local MCP clients)

VULNERS_API_KEY="your_api_key" uvx vulners-mcp

or install it

pip install vulners-mcp VULNERS_API_KEY="your_api_key" vulners-mcp

For Claude Desktop, use "command": "uvx", "args": ["vulners-mcp"] with VULNERS_API_KEY in "env".

Docker with run script

For easy HTTP mode deployment, use the provided run script:

./run-docker.sh

It runs a locally built vulners-mcp:latest image (see Building from Source). The server will start in HTTP mode at http://0.0.0.0:8000/mcp. No API key is needed to start it — see Authentication: each caller sends their own key as an X-Api-Key header per request.

Docker (manual)

Run the MCP server in HTTP mode (no API key needed to start it):

docker run -d \

--name vulners-mcp-http \ -e MCP_TRANSPORT_MODE="http" \ -e VULNERS_BASE_URL="https://vulners.com" \ -p 8000:8000 \ ghcr.io/vulnerscom/vulners-mcp:latest

Callers then send their own key per request, e.g.:

curl -X POST http://localhost:8000/mcp \

-H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "X-Api-Key: your_api_key" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_supported_os","arguments":{}}}'

For Claude Desktop (stdio mode), the -i flag is used instead, and the key *is* set as an environment variable (see Authentication — stdio has no per-request header to carry one):

docker run -i --rm \

-e VULNERS_API_KEY="your_api_key" \ ghcr.io/vulnerscom/vulners-mcp:latest

Build & run locally

git clone https://github.com/vulnersCom/vulners-mcp.git

cd vulners-mcp poetry install

Default transport is stdio, which is why a key belongs in the environment

here -- see Authentication above. Not needed/used if you instead run with

MCP_TRANSPORT_MODE=http.

export VULNERS_API_KEY="your_api_key" poetry run python -m vulners_mcp

---

Configuration / Environment Variables

| FASTMCP_HOST | str