🤖 AI Agent Integration

vulnfeed is agent-ready. Use the open JSON API to give your AI assistant real-time CVE awareness — Claude Projects, custom GPTs, LangChain, n8n and more.

You have access to vulnfeed, a real-time security vulnerability feed updated every 4 hours.

API endpoint: https://vulnfeed.it/vulns.json
Returns a JSON array of CVEs. Key fields: id, title, severity (CRITICAL/HIGH/MEDIUM/LOW), score (CVSS 0-10), epss_pct (exploitation percentile 0-100), badge ("ACTIVELY EXPLOITED" = CISA KEV), poc (true = public exploit exists), published (ISO date), affected (product list), references (patch URLs).

When the user asks about vulnerabilities, patch priorities, or CVE details:
- Fetch https://vulnfeed.it/vulns.json to get current data
- For "what should I patch?" filter where badge=="ACTIVELY EXPLOITED" or poc==true, sort by severity/score
- For a specific CVE, filter by id field
- For a product, filter title or affected fields by product name
- For weekly summary, filter published >= 7 days ago
- EPSS percentile >90 = high exploitation probability, treat as urgent

Key pages (human-readable):
- Patch now (KEV + PoC): https://vulnfeed.it/patch-now.html
- Zero-days & active exploits: https://vulnfeed.it/zero-days.html
- New this week: https://vulnfeed.it/new-this-week.html
- Trending (rising EPSS): https://vulnfeed.it/trending.html
- CVE detail: https://vulnfeed.it/cve/CVE-YYYY-NNNNN.html

You are a security vulnerability assistant with access to vulnfeed (https://vulnfeed.it), a real-time CVE aggregator updated every 4 hours.

Data source: https://vulnfeed.it/vulns.json — JSON array of current vulnerabilities.

When asked about CVEs or patch priorities:
1. Fetch the JSON API and filter/sort as needed
2. For urgent patches: filter badge=="ACTIVELY EXPLOITED" (CISA KEV) or poc==true
3. For a CVE: match on the id field
4. Always mention CVSS score, EPSS percentile, and whether it's KEV-listed
5. Link to https://vulnfeed.it/cve/[CVE-ID].html for full details

from langchain.tools import tool
import json, urllib.request

@tool
def query_vulnfeed(query: str) -> str:
    """
    Search vulnfeed for current CVE vulnerability data.
    Query can be: a CVE ID, a product name, a severity level (CRITICAL/HIGH),
    or keywords like 'actively exploited', 'patch now', 'new this week'.
    Returns matching vulnerabilities with severity, CVSS score, and EPSS percentile.
    """
    with urllib.request.urlopen("https://vulnfeed.it/vulns.json") as r:
        vulns = json.load(r)

    q = query.lower().strip()

    # KEV / patch now
    if any(x in q for x in ["patch now", "exploited", "kev", "urgent"]):
        results = [v for v in vulns if v.get("badge") == "ACTIVELY EXPLOITED"]

    # PoC / zero-day
    elif any(x in q for x in ["poc", "zero-day", "exploit code", "public exploit"]):
        results = [v for v in vulns if v.get("poc")]

    # Specific CVE ID
    elif q.startswith("cve-"):
        results = [v for v in vulns if v["id"].lower() == q]

    # New this week
    elif "this week" in q or "new" in q:
        from datetime import datetime, timedelta
        cutoff = (datetime.utcnow() - timedelta(days=7)).strftime("%Y-%m-%d")
        results = [v for v in vulns if (v.get("published") or "")[:10] >= cutoff]

    # Severity filter
    elif q in ("critical", "high", "medium", "low"):
        results = [v for v in vulns if v.get("severity", "").lower() == q]

    # Product / keyword search
    else:
        results = [
            v for v in vulns
            if q in (v.get("title") or "").lower()
            or any(q in a.lower() for a in (v.get("affected") or []))
        ]

    results.sort(key=lambda v: (
        {"CRITICAL":0,"HIGH":1,"MEDIUM":2,"LOW":3}.get(v.get("severity","UNKNOWN"),4),
        -(v.get("score") or 0)
    ))

    if not results:
        return f"No vulnerabilities found for: {query}"

    lines = [f"Found {len(results)} vulnerabilities for '{query}':\n"]
    for v in results[:10]:
        kev  = " [KEV-EXPLOITED]" if v.get("badge") == "ACTIVELY EXPLOITED" else ""
        poc  = " [PoC]" if v.get("poc") else ""
        epss = f" EPSS:{v['epss_pct']:.0f}%ile" if v.get("epss_pct") else ""
        sc   = f" CVSS:{v['score']:.1f}" if v.get("score") is not None else ""
        lines.append(
            f"• {v['id']} [{v.get('severity','?')}{sc}{epss}]{kev}{poc}\n"
            f"  {(v.get('title') or '')[:100]}\n"
            f"  Details: https://vulnfeed.it/cve/{v['id']}.html"
        )
    if len(results) > 10:
        lines.append(f"\n... and {len(results)-10} more. Full data: https://vulnfeed.it/vulns.json")
    return "\n".join(lines)

// n8n HTTP Request node → Code node workflow
// Node 1: HTTP Request
//   Method: GET
//   URL: https://vulnfeed.it/vulns.json
//   Response Format: JSON

// Node 2: Code (JavaScript)
const vulns = $input.first().json;

const urgent = vulns
  .filter(v => v.badge === "ACTIVELY EXPLOITED" || (v.poc && v.score >= 8))
  .sort((a,b) => (b.score||0) - (a.score||0))
  .slice(0, 10);

return urgent.map(v => ({
  json: {
    id: v.id,
    title: v.title?.slice(0,100),
    severity: v.severity,
    score: v.score,
    epss_pct: v.epss_pct,
    kev: v.badge === "ACTIVELY EXPLOITED",
    poc: !!v.poc,
    url: `https://vulnfeed.it/cve/${v.id}.html`
  }
}));

{
  "mcpServers": {
    "vulnfeed": {
      "command": "uvx",
      "args": ["mcp-server-fetch"],
      "env": {}
    }
  }
}

// Then in your Claude Desktop system prompt, add:
// "When asked about CVEs or vulnerabilities, fetch https://vulnfeed.it/vulns.json and filter the results."
// Or point directly at a specific page:
// - Patch now: https://vulnfeed.it/patch-now.html
// - Zero-days: https://vulnfeed.it/zero-days.html

https://vulnfeed.it/llms.txt

All endpoints are open, no API key required. Data updated every 4 hours via GitHub Actions. Full API documentation · Grafana & Prometheus integration