# CVE Risk Check

See how bad a CVE is and which dependencies to fix first. It is free, with no sign-up and no key.

## What it does

Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version).

Ask "how bad is CVE-2021-44228?", "which of these CVEs should I patch first?", "what did CISA add to its exploited list this month?" or "which dependencies in this package-lock.json should I fix first?".

CVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CISA Known Exploited Vulnerabilities (KEV) catalog lists the CVE, with CISA's due date and required action. FIRST's EPSS gives the modelled probability that the CVE is exploited in the next 30 days.

Each CVE gets a priority: "exploited" when CISA lists it, "likely" when its EPSS score is 0.1 or more, otherwise "routine", or "unknown" when EPSS could not be read. A batch of up to 10 CVEs comes back sorted with the most urgent first.

Every answer names its sources and the date the NVD record and the EPSS score are from. NVD limits requests without a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry.

For a dependency list, pass the text of a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock, go.sum or go.mod), a package.json or a requirements.txt, or a list of packages with exact versions (npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet or Packagist). Each package version is matched to its known advisories in OSV.dev, which collects the GitHub Advisory Database and other open databases. The advisories' CVE ids are then checked against the CISA exploited list and EPSS. The answer is the few packages to fix first, each with a priority (malicious, exploited, likely, routine or unknown), a one-line reason and the version to upgrade to, followed by a short list of the rest. A match is by exact name and version: it does not show that your code reaches the vulnerable code.

On CVE day, check_site_for_cve takes a site address and a new CVE and answers in one call: affected, likely affected, not affected or unknown, with a confidence score and the evidence, then copy-paste fix steps for the stack it detected (apt, dnf, Docker, cPanel, Plesk, managed WordPress, Laravel and more), a mitigation for an owner who cannot patch today and a one-line check that proves the fix is in. It loads the page once like a browser, at most 5 requests with redirects, and reads only version banners, cookies and asset paths: no payload, no probing. A distro build or a hidden version is never called affected from a header alone. Each advisory also has a page at cve.openkrill.app/day.

It also searches the oss-security mailing list, where open-source projects and Linux distributions announce their security fixes: give a package name or a CVE id and it lists the matching threads of the current and previous quarter, newest first, with links. A thread matches by its subject line, so an advisory whose subject names neither the package nor the CVE is not found.

It does not read your source code or tell you how to exploit anything, and the site check is a passive look at one public page, not a scan of your systems. The CVE ids, dependency lists and site addresses you send are not stored; the only lasting record is a daily count of calls per tool.

- Looks up a CVE's description, CVSS score and severity, and publication date from the NVD
- Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action
- Adds the EPSS score: the modelled chance of exploitation in the next 30 days
- Gives each CVE a priority: exploited, likely or routine
- Ranks a batch of up to 10 CVEs with the most urgent first
- Reads an npm, pnpm, yarn, Poetry, uv, Cargo or Go lockfile and names the 3 packages to upgrade first, with the fix
- Matches package versions to OSV.dev advisories in 8 ecosystems, including npm, PyPI, Go, Maven and crates.io
- Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word
- Links a patch or vendor advisory when NVD tags one, and names its sources and dates
- Checks a site for a new CVE in one passive page load and gives the fastest fix for its stack first
- Finds oss-security mailing list threads for a package name or a CVE id, newest first

## Who it is for

Anyone who asks an AI assistant a question like this one: “Which 3 packages in my package-lock.json should I fix first?”

Roles that use it at work: Security engineer, Software developer, Engineering manager, Security lead.

Role guides that use it: [Security engineer](https://tools.openkrill.app/for/security-engineer), [Software developer](https://tools.openkrill.app/for/software-developer).

## Price

CVE Risk Check is free to use. There is no sign-up, no account and no API key. Calls are limited to 60 calls a minute per network and 5000 calls a day per server, shared by all callers. Repeat questions are answered from a cache.

## Tools it offers

- `check_cve`: Check a CVE
- `check_cves`: Rank several CVEs
- `list_recent_kev`: List recent exploited CVEs
- `triage_dependencies`: Triage dependency vulnerabilities
- `check_site_for_cve`: Check a site for a CVE
- `list_cve_day_advisories`: List CVE day advisories
- `search_oss_security`: Search oss-security advisories

## Connect

The MCP server is `https://cve.openkrill.app/mcp` (streamable HTTP). It needs no key.

Claude Code, in one command:

```
claude mcp add --transport http cve https://cve.openkrill.app/mcp
```

Hermes Agent, in one command that answers its two setup questions (no key, enable all tools):

```
printf 'n\ny\n' | hermes mcp add cve --url https://cve.openkrill.app/mcp
```

Or add these lines to `~/.hermes/config.yaml`, under an existing `mcp_servers:` key if the file has one. Start a new Hermes session after either step.

```
mcp_servers:
  cve:
    url: https://cve.openkrill.app/mcp
```

Any other agent: give it this page's Markdown address, `https://tools.openkrill.app/tools/cve.md`, and ask it to connect CVE Risk Check.

Install guides, each checked with a real call: [CVE Risk Check in ChatGPT](https://tools.openkrill.app/integrations/cve/chatgpt), [CVE Risk Check in Claude](https://tools.openkrill.app/integrations/cve/claude), [CVE Risk Check in Cursor](https://tools.openkrill.app/integrations/cve/cursor), [CVE Risk Check in VS Code](https://tools.openkrill.app/integrations/cve/vscode), [CVE Risk Check in Pi](https://tools.openkrill.app/integrations/cve/pi).

## Job recipes for agents

Step-by-step recipes that walk an agent through 3 jobs with this server's tools:

- Check a CVE, with `check_cve`
- Rank several CVEs, with `check_cves`
- Triage dependency vulnerabilities, with `triage_dependencies`

[Download the recipes as SKILL.md](https://tools.openkrill.app/skills/cve-jobs/SKILL.md). Save it as `cve-jobs/SKILL.md` in your agent's skills folder. A connected MCP client gets the same recipes from `prompts/list` on the gateway, `https://api.openkrill.app/gateway/mcp`.

It is listed under Code and security in the [full tool list](https://tools.openkrill.app/tools). The same facts in plain text are in [llms.txt](https://tools.openkrill.app/llms.txt).

Source: the CVE Risk Check listing, version 1.4.0. As of 2026-10-18.