Audit your Node version for known CVEs and patches

cvescan by CVEspy — scan your dependencies for CVEs on every deploy

MCP server that audits npm, pip, and cargo dependencies for known CVEs using the OSV database

Search and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database. STDIO or Streamable HTTP.

Quick security check for MCP servers. Find CVEs before you connect.

SIC free code scanner — read-only static analysis for hardcoded secrets, dangerous patterns, and dependency CVEs. Zero runtime dependencies.

MCP server for osv-ui — scan npm, Python, Go, Rust, Java, PHP, and Ruby projects for CVEs with a human-reviewed dashboard

Determine which known CVEs in your Node.js dependencies are actually reachable and exploitable, using static call-graph analysis and an AI agent grounded in the real OSV advisory text.

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

QA Architect - Security audit and quality automation for AI-generated codebases. Scans for OWASP Top-10 vulnerabilities, CVEs, and common vibe-coding mistakes.

cvescan — scan your dependencies for CVEs. Unscoped alias for @cvespy/cvescan (CVEspy, cvespy.com)

Personal device security auditor — finds what antivirus misses. Scans for misconfigurations, exposed services, unpatched CVEs, privilege escalation, and hardens 120+ attack surfaces.

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1617 CVEs / 236 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate

Supply-chain risk scanner for npm, PyPI, and Maven packages - typosquats, maintainer takeovers, install-script surprises, known CVEs, and repo-wide dependency scanning. CLI for PackageSafe.

Unified security scanner (SAST + dependency CVEs + secrets) that orchestrates open-source engines and emits one report.

Supply chain security for AI-generated code - scans packages, Docker images, and IDE extensions (VS Code, Cursor, JetBrains) before install for typosquats, CVEs, sandwich-pattern attacks, and Docker tag overwriting

A simple tool that validates CVEs were published to NVD after a Node.js Security Release.

Audit your npm dependencies for outdated packages, CVEs, and health score

Scan lockfiles for known CVEs using the VulnScope database (OSV + KEV + EPSS).

Check risk scores for CVEs