Today ainotis Join

My notis

ToolingPublished All news from that day

Sazabi launches cve.now, a free vulnerability feed with an MCP server covering about 30 days

The service merges the CVE List, CISA's exploited-vulnerabilities list, EPSS and OSV, and needs no login.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

Share

Check our sources · 5 facts from 1 source

Sazabi announced cve.now in a blog post that gives no date. The post describes it as a free feed of CVEs and security advisories for agents and the teams that use them. It says the service merges the CVE List, CISA's list of exploited vulnerabilities, EPSS and OSV, and refreshes every 5 minutes.

The feed is available as RSS, JSON or an API, and there is an MCP server with three tools: get_vulnerability, list_feed and check_stack. The post says no login, signup or API key is required.

It lists its own limits: it holds about the last 30 days of the CVE List, so finding nothing for a project's dependencies does not mean they are free of older vulnerabilities.

Share this story

Your reaction

We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.

Check our sources

Every sentence above is checked against this source.

1 Introducing cve.now: a free feed of security vulnerabilities for agentsSazabi · 5 facts Open the source archived copy

  1. Sazabi's post introduces cve.now as "a free feed of CVEs and security advisories for agents and the teams that use them"; the page carries no publication date.

    cve.now is a free feed of CVEs and security advisories for agents and the teams that use them.
    cite

  2. The post says cve.now merges "the CVE List, CISA's list of exploited vulnerabilities, EPSS, and OSV" and "Every 5 minutes, cve.now pulls new and updated records" from them.

    cve.now merges siloed data sources (the CVE List, CISA's list of exploited vulnerabilities, EPSS, and OSV) ... Every 5 minutes, cve.now pulls new and updated records
    cite

  3. The post says: "The feed is available as RSS, JSON, or API, and there's an MCP server that gives your coding agent direct access"; the server is a remote Streamable HTTP server with no authentication, offering the tools get_vulnerability, list_feed and check_stack.

    Toned down to what the source says
    The feed is available as RSS, JSON, or API, and there's an MCP server that gives your coding agent direct access to this critical information.
    cite

  4. The post says: "cve.now is free for anyone to use. No login, signup, or API key required."

    cve.now is free for anyone to use. No login, signup, or API key required.
    cite

  5. The post lists as a limitation: "cve.now has about the last 30 days of the CVE List." It adds that finding nothing for your dependencies "doesn't mean you're safe from older vulnerabilities".

    cve.now has about the last 30 days of the CVE List. ... if cve.now finds nothing for your dependencies, that doesn't mean you're safe from older vulnerabilities.
    cite

Topics

The morning email

On the mornings we publish: the three top stories and up to four short ones. Free.

We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep