cve-fix-check

MCP server for CVE lookup + fixed-version availability — for packages, container images, and SBOMs. Built for AI agents that need to answer the question scanners skip: "is there a fixed package I can actually upgrade to, today?"

• Free, local, keyless. All sources are public APIs fetched directly from your machine — OSV.dev, FIRST EPSS, the Alpine & Wolfi security databases, and the Ubuntu security tracker.
• Zero telemetry. Nothing proxies through us; there is no "us" at runtime.
• Born in production. We maintain 130+ hardened OS/app images across the Azure, AWS, and OCI marketplaces on a continuous CVE-rebuild treadmill — this server packages the exact checks that pipeline runs every day.

Install (Claude Code / any MCP client)

{
  "mcpServers": {
    "cve-fix-check": { "command": "npx", "args": ["-y", "cve-fix-check"] }
  }
}

Requires Node ≥ 20. No configuration, no accounts, no API keys.

Tools

| Tool | Question it answers | |---|---| | cve_lookup | What is CVE-X / GHSA-Y? Severity, EPSS exploit-prediction score, affected packages, fixed versions, aliases. | | package_vulns | What's known against [email protected] (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Alpine, Wolfi, Debian, Ubuntu)? | | fix_availability | Is a fixed package in the distro repo right now? Checks Alpine secdb / Wolfi feed / Ubuntu tracker → FIXED_AVAILABLE (with version), NOT_FIXED_YET, NOT_AFFECTED, NOT_LISTED, UNKNOWN_PACKAGE, SOURCE_UNAVAILABLE. | | sbom_scan | Which components of this CycloneDX/SPDX SBOM (or purl list) are vulnerable? Batch query with severity hydration and honest truncation notes. |

Example: the daily rebuild question

"Trivy flagged CVE-2024-6119 in openssl on our alpine:3.20 image — can we rebuild our way out of it right now?"

fix_availability { cve: "CVE-2024-6119", package: "openssl", target: "alpine:v3.20" }
→ { "verdict": "FIXED_AVAILABLE", "fixed_version": "3.3.2-r0",
    "detail": "apk upgrade to openssl>=3.3.2-r0 on v3.20", ... }

That verdict is the difference between "rebuild now" and "waste a rebuild cycle re-finding the same CVE" (we learned this the hard way).

Resilience

Distro endpoints flake (ubuntu.com's CVE API 504s on large records — it was down the day we wrote our smoke tests). The server retries with backoff, and for Ubuntu falls back to Canonical's OSV feed; when a source is truly unreachable you get a structured SOURCE_UNAVAILABLE verdict, never a tool crash — agents read verdicts well and handle exceptions badly.

Honest scope (v0.1)

• Coverage is OSV's coverage: open-source ecosystems. A CVE against closed-source software or an OS kernel may return found: false.
• Fix-availability targets: alpine:vX.Y, wolfi, ubuntu:XX.YY. Debian/RHEL-family trackers are on the roadmap.
• CVE records without ecosystem data point you at their GHSA alias for per-ecosystem fix versions.
• This is a lookup/triage tool, not a scanner: generate SBOMs with Trivy or Syft, then interrogate them here.

Development

npm install
npm run build   # tsc → dist/
npm test        # unit tests (offline, fixture-based)
npm run smoke   # live API smoke (network)
npm run e2e     # real MCP client ↔ server over stdio

License

Apache-2.0. © Derek Coleman & Associates Inc.