MCP Observatory
1m ago Tracked 60,039 Last 1m ago 24h 2,475
github Python analyzed e708afc

vulnersCom/api

github

Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.

maintainer
vulnersCom
licence
MIT
first seen
2026-07-25
last seen
2026-09-04
releases · 30d
1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 8 tools
transport stdio counts 8 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • audit_linux
  • audit_metadata
  • audit_software
  • cve_lookup
  • get_bulletin
  • search_bulletins
  • search_exploits
  • smart_audit
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e708afc · analyzer v33 · 2d ago

skills & prompt files 2

danger signals8

code evidence vv4.3.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 173

filesystem 22

  • fs vulnersCom-api-e708afc/dev-tools/data-models/_emit_bulletins.py :24 import shutil
  • fs vulnersCom-api-e708afc/dev-tools/data-models/_emit_docs.py :15 import shutil
  • fs vulnersCom-api-e708afc/dev-tools/data-models/_paths.py :5 from pathlib import Path
  • fs vulnersCom-api-e708afc/dev-tools/generate_api_md.py :25 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/scripts/bc_snapshot.py :149 with open(args.out, "w", encoding="utf-8") as fh:
  • fs vulnersCom-api-e708afc/src/vulners/_base_client.py :433 with archive.open(names[0]) as member:
  • fs vulnersCom-api-e708afc/src/vulners/_download.py :124 os.unlink(tmp_path)
  • fs vulnersCom-api-e708afc/src/vulners/_resources/_async/archive.py :28 # archive-open (the billable step) and charges a second time. ``idempotent=False``
  • fs vulnersCom-api-e708afc/src/vulners/_resources/_async/audit.py :33 with open(path, "rb") as handle:
  • fs vulnersCom-api-e708afc/src/vulners/_resources/_sync/archive.py :30 # archive-open (the billable step) and charges a second time. ``idempotent=False``
  • fs vulnersCom-api-e708afc/src/vulners/_resources/_sync/audit.py :36 with open(path, "rb") as handle:
  • fs vulnersCom-api-e708afc/src/vulners/base.py :8 import pathlib
show 10 more
  • fs (weak) vulnersCom-api-e708afc/tests/bc/test_bc_oracle.py :18 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/bc/wire_baseline.py :27 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/core/test_download.py :444 fd = os.open(p, os.O_RDWR | os.O_CREAT)
  • fs (weak) vulnersCom-api-e708afc/tests/live/conftest.py :21 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/test_deprecations.py :16 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/test_endpoint_codegen.py :11 import pathlib
  • fs (weak) vulnersCom-api-e708afc/tests/test_invoke.py :194 # base.py calls the open() builtin; shadow it via a module attribute
  • fs (weak) vulnersCom-api-e708afc/tests/test_packaging.py :10 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/test_samples.py :13 from pathlib import Path
  • fs (weak) vulnersCom-api-e708afc/tests/test_smoke.py :14 from pathlib import Path

shell / exec 5

  • shell vulnersCom-api-e708afc/dev-tools/data-models/_emit_bulletins.py :25 import subprocess
  • shell (weak) vulnersCom-api-e708afc/tests/bc/test_bc_oracle.py :16 import subprocess
  • shell (weak) vulnersCom-api-e708afc/tests/test_deprecations.py :12 import subprocess
  • shell (weak) vulnersCom-api-e708afc/tests/test_endpoint_codegen.py :323 import subprocess
  • shell (weak) vulnersCom-api-e708afc/tests/test_smoke.py :10 import subprocess

network 71

  • net vulnersCom-api-e708afc/dev-tools/data-models/_sample.py :103 # Runs in a worker thread: httpx.Client is safe for concurrent requests
  • net vulnersCom-api-e708afc/src/vulners/_base_client.py :24 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_client.py :3 Two mirror clients: a synchronous one owning an ``httpx.Client`` and an async one
  • net vulnersCom-api-e708afc/src/vulners/_config.py :15 import urllib.request
  • net vulnersCom-api-e708afc/src/vulners/_download.py :30 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_exceptions.py :378 with a case-insensitive ``.get`` (an ``httpx.Headers``); ``parsed_body`` is
  • net vulnersCom-api-e708afc/src/vulners/_logging.py :44 # httpx logs the request URL as an ``httpx.URL`` (not a str), and
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/_base.py :20 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/archive.py :17 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/audit.py :17 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/documents.py :13 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/misc.py :11 import httpx
show 28 more
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/report.py :12 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/search.py :16 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/stix.py :12 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/subscriptions.py :12 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/subscriptions_v4.py :17 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/vscanner.py :17 from urllib.parse import quote, unquote, urlsplit
  • net vulnersCom-api-e708afc/src/vulners/_resources/_async/webhooks.py :20 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/_base.py :24 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/archive.py :19 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/audit.py :18 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/documents.py :15 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/misc.py :13 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/report.py :14 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/search.py :18 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/stix.py :14 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/subscriptions.py :14 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/subscriptions_v4.py :19 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/vscanner.py :19 from urllib.parse import quote, unquote, urlsplit
  • net vulnersCom-api-e708afc/src/vulners/_resources/_sync/webhooks.py :22 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_response.py :24 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_transport.py :17 import socket
  • net vulnersCom-api-e708afc/src/vulners/_transport_client_async.py :16 import httpx
  • net vulnersCom-api-e708afc/src/vulners/_transport_client_sync.py :19 import httpx
  • net vulnersCom-api-e708afc/src/vulners/base.py :22 from urllib.parse import parse_qsl, quote, urlencode
  • net vulnersCom-api-e708afc/src/vulners/vscanner.py :7 from urllib.parse import unquote, urlsplit
  • net (weak) vulnersCom-api-e708afc/tests/bc/wire_baseline.py :30 import httpx
  • net (weak) vulnersCom-api-e708afc/tests/conftest.py :12 import httpx
  • net (weak) vulnersCom-api-e708afc/tests/core/test_archive.py :10 import httpx

31 more not shown — this panel samples each group; the count above is the real total.

secrets 16

  • secrets (weak) vulnersCom-api-e708afc/.agents/skills/vulners-api/scripts/smoke_vulners_api.py :32 has_api_key = bool(os.getenv("VULNERS_API_KEY"))
  • secrets vulnersCom-api-e708afc/dev-tools/data-models/_sample.py :22 k = os.environ.get("VULNERS_API_KEY")
  • secrets vulnersCom-api-e708afc/samples/legacy/cpe_search.py :11 api = vulners.VulnersApi(api_key=os.environ["VULNERS_API_KEY"])
  • secrets vulnersCom-api-e708afc/samples/legacy/exploits.py :11 api = vulners.VulnersApi(api_key=os.environ["VULNERS_API_KEY"])
  • secrets vulnersCom-api-e708afc/samples/legacy/linux_audit.py :13 api = vulners.VulnersApi(api_key=os.environ["VULNERS_API_KEY"])
  • secrets vulnersCom-api-e708afc/samples/legacy/search.py :11 api = vulners.VulnersApi(api_key=os.environ["VULNERS_API_KEY"])
  • secrets vulnersCom-api-e708afc/samples/legacy/software_scanner.py :11 api = vulners.VulnersApi(api_key=os.environ["VULNERS_API_KEY"])
  • secrets vulnersCom-api-e708afc/samples/v4/async_search.py :14 async with AsyncVulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
  • secrets vulnersCom-api-e708afc/samples/v4/cpe_search.py :11 with Vulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
  • secrets vulnersCom-api-e708afc/samples/v4/exploits.py :11 with Vulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
  • secrets vulnersCom-api-e708afc/samples/v4/linux_audit.py :13 with Vulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
  • secrets vulnersCom-api-e708afc/samples/v4/search.py :11 with Vulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
show 4 more
  • secrets vulnersCom-api-e708afc/samples/v4/software_scanner.py :11 with Vulners(api_key=os.environ["VULNERS_API_KEY"]) as v:
  • secrets vulnersCom-api-e708afc/src/vulners/_config.py :231 env_key = os.environ.get("VULNERS_API_KEY", "").strip()
  • secrets (weak) vulnersCom-api-e708afc/tests/live/conftest.py :32 key = os.environ.get("VULNERS_API_KEY")
  • secrets (weak) vulnersCom-api-e708afc/tests/test_samples.py :55 assert 'os.environ["VULNERS_API_KEY"]' in source

tool registrations 8

  • search_bulletins vulnersCom-api-e708afc/src/vulners/_mcp/server.py :230
  • get_bulletin vulnersCom-api-e708afc/src/vulners/_mcp/server.py :256
  • search_exploits vulnersCom-api-e708afc/src/vulners/_mcp/server.py :311
  • cve_lookup vulnersCom-api-e708afc/src/vulners/_mcp/server.py :339
  • audit_software vulnersCom-api-e708afc/src/vulners/_mcp/server.py :368
  • audit_linux vulnersCom-api-e708afc/src/vulners/_mcp/server.py :394
  • smart_audit vulnersCom-api-e708afc/src/vulners/_mcp/server.py :415
  • audit_metadata vulnersCom-api-e708afc/src/vulners/_mcp/server.py :437

declared dependencies 11

  • fastmcp@>=2.0,<4
  • httpx@>=0.28,<1
  • pydantic@>=2.13,<3
  • orjson@>=3.11,<4
  • typing-extensions@>=4.16
  • t@break imports.
  • brotli@>=1.2,<2
  • zstandard@>=0.25,<1
  • isal@>=1.8,<2
  • ijson@>=3.5,<4
  • opentelemetry-api@>=1.20

perm:untrusted 1

  • untrusted (weak) vulnersCom-api-e708afc/tests/test_invoke.py :100 assert req.content == httpx.Request("POST", req.url, json=payload).content