Vulners MCP: CVE triage and package audits from your AI app

How to add Vulners to Claude, ChatGPT or Cursor

1. 1Click Connect Vulners free. There's no sign-in, so its tools are ready at once.
2. 2All seven tools look things up. The two audit tools, `audit_software` and `audit_linux_packages`, send your software versions to Vulners; switch them off if your package lists shouldn't leave your network, and keep `bulletin_by_id` for public CVE lookups.
3. 3Add ContextGate to your AI app as a connector or MCP server. The steps for each app are on the Works with page.
4. 4Ask your AI app for the CVSS and EPSS scores of a recent CVE, then open Activity to see the `bulletin_by_id` call.

Vulnerability research with Vulners from Claude or Cursor

• Fetch a bulletin by CVE or Vulners ID with `bulletin_by_id` and get a short triage card: title, CVSS3, EPSS and related CVEs.
• Search the Vulners knowledge base with Lucene queries through `search_lucene` when you don't have an ID yet.
• Check exact software versions for known vulnerabilities with `audit_software`, or audit RPM and DEB packages for a distro and version with `audit_linux_packages`.
• Find the CPE string for a vendor and product with `search_cpe`.

What leaves your network, and what's recorded

• Switch off the audit tools to keep your AI app to public CVE data; switched-off tools are hidden and refused if called.
• A policy can block secrets or internal hostnames in a package list before an audit call goes out.
• Activity records every Vulners lookup, so you can see which CVEs your team checked and when.

What you get with Vulners and ContextGate

• Your AI apps can use VulnersClaude, Cursor, ChatGPT and other AI apps reach Vulners through the one ContextGate connection you add to them.
• You choose which tools they can useSwitch off any Vulners tool you don't want used. It's hidden from your AI apps and refused if called.
• Every call is checked and recordedYour policies check each call (for example, personal data is hidden and secrets are blocked), and Activity keeps a record of it.

ContextGate sees only the tool calls that go through it, not your AI app's built-in tools or your chats.

Vulners tools

Examples of what your AI apps can do in Vulners. You'll see the exact list of tools after you connect it.

• bulletin_by_id🚨 PRIMARY TOOL FOR KNOWN IDs 🚨 Fetch a bulletin by CVE or Vulners ID. Returns a COMPACT triage-card summary by default -- id, title, CVSS3, EPSS, CVE list, and
• search_lucene🔍 DISCOVERY TOOL FOR UNKNOWN VULNERABILITIES 🔍 Full-text search in Vulners Knowledge Base using Lucene syntax. Use ONLY when you don't have specific IDs or vers
• audit_software🔍 VERSION-SPECIFIC SOFTWARE AUDIT 🔍 Audit specific software versions for known vulnerabilities. Use this when you have exact software version information (e.g.,
• get_supported_osList supported OS identifiers/versions for Linux package audit. Get available operating systems for vulnerability analysis.
• audit_linux_packagesLinux package audit (RPM/DEB) for a given distro + version. Analyze Linux package vulnerabilities against the Vulners database.
• query_autocompleteAutocomplete helper for search inputs (vendors, products, CVEs, etc.). Get search suggestions from the Vulners database.
• search_cpeFind CPE strings by vendor+product (latest schema). Search for Common Platform Enumeration identifiers in the Vulners database.