VulnSea
← All posts

What's new: open corpus, three new MCP tools, vendor advisories, package pages

· VulnSea
announcementsagentsapimcp

Two weeks of shipping, summarised. The short version: the whole corpus is open, there are no paid tiers any more, and most of the new work went into the surfaces that agents use. Details below, agent-facing changes first.

For agents

Everything on this list is live on the REST API, the MCP server and /llms.txt today.

  • No key needed to read anything. The free window on recent CVEs is gone. Every record, every endpoint, every tool answers anonymously. An API key only raises the rate limit (60/min → 600/min).
  • No more not_found for real ids. The corpus is filled by demand now: ask get_cve, resolve_id, /api/cve/<id> or a CVE page for an id that is not in the corpus and it is fetched live from CVE.org and NVD, written, and served in a few seconds. Every later request is an ordinary hit. A GHSA id is mapped to its CVE first.
  • Four new MCP tools, taking the server to eleven:
    • changes_since — a mutation feed. Not "what is new" but "what changed about records you already triaged": KEV added, severity bumped, exploited flipped, material EPSS move. Append-only events with an exact numeric cursor, so a re-triage loop never double-processes. REST twin: /api/changes.
    • resolve_id — hand it a GHSA-… or any other alias and get the canonical VulnSea record, aliases and URL back. For when an upstream tool speaks in non-CVE ids. REST twin: /api/resolve.
    • get_epss_movers — CVEs whose exploit-prediction probability climbed the most over a window. Rising risk before it lands in KEV. REST twin: /api/movers.
    • get_digest — one weekly or daily digest period as compact rows: what was published, KEV additions, EPSS risers, most-changed.
  • MCP resources, prompts and annotations. Clients can attach vulnsea://cve/{id} or vulnsea://digest/week as context without a tool call. Three prompts (triage_sbom, explain_cve, weekly_patch_plan) are ready-made workflows. Every tool is annotated read-only, so clients skip the confirmation dialog.
  • OSV-compatible endpoints. POST /api/osv/v1/query and /querybatch accept the same request shape as osv.dev, so existing OSV clients and scanners can be pointed at VulnSea without code changes.
  • Bulk dataset. GET /api/dump streams the corpus as NDJSON, one frontmatter record per line; add since for a delta. For anyone who wants the data local instead of paged.
  • SBOM triage got wider. /api/sbom and triage_sbom now match on purl + version ranges across npm, PyPI, Go, crates, Maven, NuGet, RubyGems, Packagist, and OS packages (deb / rpm purls) via distro advisories.
  • Package filter everywhere. /api/cve?pkg=<name>, feed.xml?pkg=<name> and a /package/<name> page for every affected package.
  • Richer records. Frontmatter now carries ssvc (CISA's exploitation / automatable / technical-impact decision), an exploits object listing public PoCs, Metasploit modules and Nuclei templates, and a per-source scores map (see below). get_cve and the .md files return all of it.
  • MCP server packaged for distribution. The repo now carries a registry manifest (server.json) and tiny TypeScript and Python example clients, so a working integration is a copy-paste away.

New data

  • CVE.org as a source. Hourly walk of the CVE Program's own records. Brings the CNA's CVSS and CWE, affected versions without CPE, and SSVC — often hours to days before NVD finishes analysing. When NVD has not caught up, the CVE.org record stands on its own.
  • Vendor advisories (CSAF). Red Hat VEX and Cisco feeds are merged in, adding vendor severity and per-product fix status. More providers are config, not code.
  • Exploit availability, aggregated. Beyond the Exploit-DB flag: GitHub PoC repositories, Metasploit modules and Nuclei templates, refreshed daily. Any hit sets the exploit-available tag and an "Exploit availability" section on the CVE page.
  • Per-source CVSS and score disputes. NVD, the CNA, CISA ADP, GitHub, OSV and vendors all score independently and disagree more than you would think. Every source's number is kept, the page shows them side by side, and a spread of 2.0 or more earns the score-dispute tag — /tag/score-dispute is the filter.
  • Timeline per CVE. Published → analysed → PoC public → KEV added → EPSS moves, drawn as one strip on the record.
  • Notes. A curated notes layer renders above the generated body when we have something to add that the sources do not say.

New pages

  • /package/<name> — every CVE touching a package, with its own RSS feed.
  • Dated digests — weekly and daily pages with permanent URLs: KEV additions, EPSS risers, new criticals, most-changed.
  • Trending by chatter. Mention counts from Bluesky and Hacker News for CVEs from the last 30 days, hourly, on the home page and Trends.
  • Vendor pages as intelligence. Patch cadence, exploited ratio, monthly chart, worst products, plus a per-vendor RSS link. Same for tags and CWEs.
  • /docs/depth-score — the methodology behind the 0–100 score, with worked examples.
  • /status — per-source freshness, so a stale feed is visible instead of hidden behind one global number.

Housekeeping

  • Paid plans, Stripe and the pricing page are gone. The site is ad-supported; ads never appear on API responses, markdown records, feeds or the MCP endpoint. A sponsor page exists for anyone who wants a labeled placement instead.
  • On-demand PoC requests are back for signed-in accounts, two open at a time.
  • The Bluesky announcer now only posts CVEs published in the last four weeks, so a decades-old record picking up a metadata update no longer makes the feed.
  • Cookieless analytics, no consent banner of our own, and a tidier header and page width.

Sound the depths → vulnsea.com

What's new: open corpus, three new MCP tools, vendor advisories, package pages · VulnSea