Your coding agent can read your repository and run commands on your servers. What it cannot know is which of this week's vulnerabilities affect your applications. The vulneraibility.com MCP server gives it exactly that, so it can check whether a vulnerable function is called or a module loaded, fix what is real and document what is not.
Fourteen MCP tools over HTTP: search your matched CVEs, read full analyses, manage your stack and applications, and set statuses with notes.
The agent compares an advisory's conditions with your code and servers: is the function called, the module loaded, the platform the same?
Real findings become upgrade pull requests; unreachable ones become a decision with the evidence in the note.
Same plan rules and rate limits as the API, a human approves writes, and every change made through MCP is labelled as such in the history.
Which CVEs affect this application?
Affected versions, vulnerable function, preconditions.
Code and server, read-only.
Upgrade pull request, or evidence of non-reachability.
Status and note written back through MCP.
Any MCP client that supports remote HTTP servers, including Claude Code, Claude Desktop and Cursor. Connection takes an API key and one command or configuration entry.
Only what your API key allows: statuses, notes, your stack and applications. Keep a human approving writes; every change is recorded as made via MCP.
The same capabilities are available through the REST API, so a pipeline or ticketing integration can use them directly.