AppThreat Vulnerability Database MCP server
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-server-vdb","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Introduction This folder contains the source code for running VDB as a Model Context Protocol (MCP) server. Below you can find the configuration for running the VDB MCP server with Claude Desktop. Please feel free to share the configuration for other [clients](https://modelcontextprotocol.io/clients) via pull requests. ## What is available The MCP server provides: - Structured JSON tool results with summaries and machine-readable evidence. - Bulk search tools for package lists and CycloneDX BOMs. - Filter-aware search for severity thresholds, sources (`osv`, `nvd`, `github`, `aqua`), date ranges, malware-only / exclude-malware, package scope (`app_only`, `os_only`), package ecosystem, and pagination. - Metadata and full-text search over aliases, references, package names, descriptions, and affected functions/modules. - Resource templates such as `cve://{id}` and `purl://{purl}`. - Concrete resources such as `vdb://metadata`, `vdb://health`, `vdb://sources`, and `vdb://malware/latest`. - A `db_refresh` tool that fetches or refreshes local data through the same staged, validated, atomically-swapped path as `vdb db refresh` — `{"target": "full"}` (optionally `app_only` or an `image` URL override), `{"target": "shards", "shards": ["npm", "pypi"]}`, or `{"target": "sync"}` (the default: refresh everything already local). Every result carries the post-refresh health report. - Richer prompts for package-risk assessment, CVE triage, SBOM summaries, fix prioritization, version-match explanations, and overlay review. ### VDB 7 shard stores, coverage, and health VDB 7 data can be a full database under `VDB_HOME` or a set of type shards (see the root [README type-shard section](../../README.md#type-shard-databases-v7-preview)). The server is honest about which one it has: - Every tool payload carries a `status`: `ok`, `coverage_gap` (some requested purl types have no local shard — those results were NOT checked), or `stale_data` (a shard lags its siblings by more than…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.