About Vulnrable

Vulnrable tracks published vulnerabilities and security advisories, and grades the security posture of MCP servers — the tools people connect to AI agents. Everything here is automated aggregation of public data. It is not a paid service and nothing on it is for sale.

What's here

Vulnerabilities: Recent CVEs and advisories, ranked by whether they're known to be exploited and by their EPSS exploitation probability.
MCP directory: 43 MCP servers scanned for known vulnerabilities, deprecation, supply-chain signals and dependency footprint.
MCP config checker: Paste your .mcp.json and get a report. Parsing happens in your browser — the config and any secrets in it never leave your machine. Only package names are sent, to look them up.
Dependency checker: Check a lockfile against known vulnerabilities.
Weekly digest: A summary of the week's notable security news.

Where the data comes from

NVD — CVE records from the US National Vulnerability Database.
OSV and GitHub Security Advisories — package-level advisories.
CISA KEV — the Known Exploited Vulnerabilities catalogue: things confirmed to be exploited in the wild.
EPSS — FIRST's model estimating the probability a vulnerability will be exploited.
npm and PyPI — package metadata: versions, deprecation status, maintenance activity, dependencies.

All of these are public sources. Vulnrable aggregates and presents them; it does not perform its own vulnerability research and does not discover or disclose new issues.

How grades work

Each MCP server gets a letter grade derived from findings against its registry metadata and published advisories. Two high-severity findings give an F, one gives a D, and medium findings step the grade down from A. A ? means the registry lookup failed — nothing was assessed, and no claim is made either way.

Low grades restate facts that others published. A deprecation notice comes from the package owner's own npm metadata; a vulnerability comes from a filed advisory with an identifier you can look up. The grade is a synthesis of those facts, not a judgement about the code itself.

What this is not

Not a code audit. Nothing here reads or analyses source code — it reads metadata.
Not a guarantee. A grade of A means no findings surfaced from the signals checked, not that software is safe.
Not exhaustive. The vulnerability view tracks a working pool of recent records, not every CVE ever filed.
Not real-time. Grades recompute when the site is rebuilt; dependency counts refresh separately. Both pages state the dates they were last scanned.

Corrections

If you maintain a package listed here and a grade is wrong or out of date — a deprecation that's been lifted, an advisory that's been withdrawn, a fix not yet picked up — it should be corrected. Each server page shows the date it was last scanned, so you can see whether the data predates your change. Reach out on LinkedIn and it will be looked at.

Who runs it

Built and maintained by Madhukara Hebbar. It exists because the tooling around AI agent security is thin, and because a dependency you have not looked at is still a dependency you are trusting.