Dependency Auditor — checks installed npm packages for CVEs, deprecations, and abandonment.

Security scanning CLI for React and Next.js — detects CVEs, secrets, license risks, supply chain threats, hydration bugs, RSC boundary violations, and more.

MCP server for the ThreatCluster threat-intelligence API: incident clusters, entity profiles, CVEs and ransomware leak-site victims as tools for Claude, Cursor, VS Code and any MCP client

A JavaScript library for dealing with NVD, CVEs, and CPE strings.

A fork of tiny-emitter by Scott Corgan with fixed CVEs and updated build process.

Bun security scanner — OSV CVEs, publish age, install scripts, and more

301 real-time data wires for AI agents. Paid per call via x402 (USDC on Base), no API key, no signup, and no free data tier. Primary sources, not a crawler index: SEC EDGAR, the Federal Reserve, BLS/BEA, federal courts, Congress, DOJ, FDA, CISA/CVEs, USGS

Security-first, modular Node.js system information library. Zero CVEs. Fast Windows support. No build step.

Security scanner for MCP servers — detect vulnerabilities, CVEs, and attack vectors

Agents should invoke this skill when checking CVEs or known vulnerabilities in installed packages, dependencies, Docker images, OS packages, exposed services, or software versions. Produces severity-rated scan reports.

Local stdio MCP server for Dynamic Feed — live data AI models lack (prices, weather, CVEs & exploited vulns, internet outages, global disasters, satellites/space, world news + more). Bridges any MCP client to dynamicfeed.ai; works through firewalls that b

Scan dependencies for supply-chain risk: EOL versions, CVEs, abandonment, typosquatting, license compliance, maintainer takeover patterns, and OPA policy gating

Diff two CycloneDX or SPDX SBOMs and produce human-readable change reports. Highlights added, removed, upgraded dependencies and new CVEs.

Morning supply-chain safety scan for npm, PyPI, Docker, Go, Rust and NuGet projects (monorepo-aware, recursive) — known-malicious packages + CVEs + freshly-published deps + release-cooldown/digest pinning + install-time protection (Aikido Safe Chain) chec

Supply-chain scanner that audits npm dependencies for typosquats, malicious install scripts, license risk, and known CVEs.

[](https://www.npmjs.com/package/@brickhouse-tech/angular-lts) [](https://www.npmjs.com/package/@

Scan package.json, requirements.txt, Cargo.toml, and go.mod for known CVEs. Offline database of vulnerabilities, no API needed.

Scrape the GitHub Advisory Database (GHSA) — security advisories mapped to CVEs, affected packages, version ranges, CVSS and CWE. Filter by ecosystem (npm, pip, maven...) and severity. Official keyless API. Schedule as a dependency-vulnerability monitor.

Cross-agent security posture scanner for self-hosted AI agents (OpenClaw, Hermes). 19 checks across exposure, gateway auth, secrets, CVEs, and malicious skills (taint + prompt-injection analysis) — graded A–F, mapped to CWE/OWASP-LLM/MITRE ATLAS. Zero dep

Seenty MCP server — query your monitors, uptime and security findings (secrets, cloud misconfigs, CVEs) from AI clients