Open-Source OSV-Compliant Model Context Protocol (MCP) Vulnerability Advisory Database
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-vulnerabilities","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Open-Source MCP Vulnerability Advisory Database [](https://github.com/JMartynov/mcp-vulnerabilities/actions/workflows/daily_sync.yml) [](data/vulnerabilities) [](https://ossf.github.io/osv-schema/) [](LICENSE) [](https://jmartynov.github.io/mcp-vulnerabilities/) [](https://jmartynov.github.io/mcp-vulnerabilities/updates.html) An open-source, automated **Open Source Vulnerability (OSV 1.6)** compliant security advisory database specifically curated for the **Model Context Protocol (MCP)** ecosystem. ## Sources - **CVE List v5**: Official CVE JSON 5.0 records. - **GitHub Security Advisories (GHSA)**: Live GraphQL/REST security alerts. - **OSV.dev**: Unified open-source vulnerability database. - **National Vulnerability Database (NVD)**: CVE 2.0 vulnerability metrics and CVSS scores. ## Snapshot Downloads & Mirrors You can download pre-compiled vulnerability database snapshots, OSV buckets, and air-gapped enterprise bundles directly from our latest GitHub Release. Download the latest consolidated JSON snapshot: ```bash curl -sL https://github.com/JMartynov/mcp-vulnerabilities/releases/latest/download/vulnerabilities.json.gz -o vulnerabilities.json.gz ``` Verify integrity using the provided SHA-256 checksums: ```bash curl -sL https://github.com/JMartynov/mcp-vulnerabilities/releases/latest/download/SHA256SUMS.txt -o SHA256SUMS.txt sha256sum -c SHA256SUMS.txt --ignore-missing ``` ## Fa…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.