I built this because I kept asking Claude to check my dependencies for known vulns and it would either make up CVEs or tell me to go run something myself. VulnFeed is an MCP server that gives an agent real, current vulnerability data it can actually call.
The useful bit in one line: point it at a `package-lock.json` / `requirements.txt` / `go.sum` / etc. and it returns the known CVEs, each scored by EPSS (the probability it'll actually be exploited — so you triage the 2 that matter instead of the 40 that don't), plus the fixed version.
Boring details: the client is MIT (github.com/novadyne-hq/vulnfeed-mcp, on PyPI as `vulnfeed-mcp`). Scanning is free. Two of the nine tools — detailed single-CVE lookup and continuous project monitoring — are paid; you can pay per call with no account at all (HTTP 402 micropayment) or subscribe, so there's no signup wall just to try it. The hosted backend is closed for now.
I'd genuinely like feedback on three things: (1) what tools are missing that you'd want your agent to have, (2) does per-call vs subscription pricing make sense here, (3) how's the data freshness / any false positives you hit.
Spot on. All those years of slinging code and debugging gave me and others the judgement and eye to check on all the AI generated code. I now wonder often about what hiring looks like in this new era. As a small startup, we just don't need junior engineers to do the day to day implementation.
Do we instead hire a small number of people as apprentices to train on the high level patterns, spot trouble areas, develop good 'taste' for clean software? Teach them what well organized, modular software looks like on the surface? How to spot redundancy? When to push the AI to examine an area for design issues, testability, security gaps? Not sure how to train people in this new era, would love to hear other perspectives.
Solo here, no devs to fire. What's changed is the bar for "worth building" dropped massively. Stuff I'd have shelved as too small to justify the time, I just do now. The risk is that you end up with a lot of half-finished things if you're not disciplined about finishing.
Been looking for something like this for a side project. The embedded mode with no external deps is the killer feature for me, hate dragging in a server just to do graph traversal. Going to give it a shot.
Sign extension bugs are the worst. Silent for ages then suddenly everything is on fire. Spent a lot of time in C doing low-level firmware work and ran into the same class of issue more than once. Nice writeup, congrats on the patch.
Went indie after a long run at a big company and this hits. The hardest thing wasn't the work, it was getting comfortable with the silence between shipping and seeing any signal. Still working on it tbh.
You are correct, the data is not client side encrypted. Data entry is either manual, or for many major brokerages we offer a drag/drop import of CSVs. There is also a generic CSV upload capability.
Good valid points here though on being in the privacy 'middle ground'. There is some trust involved with having your transaction data live on our server, and that we execute correctly on our promise of only extracting transaction data from the (optional) CSV upload process.
Your comments have sparked some ideas on how we could go deeper in the privacy direction, so thanks for taking the time!
EDIT: Noted on the landing page having more emphasis on the full asset type support, thanks for the feedback.
FortunesRise was born from my desire to understand the performance of my investments and make better investing decisions. I was frustrated that I could not easily compare how my stocks, retirement accounts, rental property, and cryptocurrencies were all doing relative to each other. Without that information, I didn't feel like I was in full control.
I went looking for solutions and found some interesting options - but most of them required me to give up my bank and brokerage login data. For me this was a non-starter. I was just not comfortable entrusting a company with that sensitive information no matter how well intentioned they were.
Thus, FortunesRise was born. We strive to pack key information into an intuitive and easy to compare format. The goal is to have data to understand both past performance and to guide decisions on what to do next. FortunesRise is simply a tool for making better investing decisions, we don't sell your data to anyone or push investing advice and products.
I hope some of you out there will find FortunesRise as useful as I do. I use it pretty much every day and it has improved my own investing significantly. Feel free to ask me any questions about the app or the development process, I'm happy to help out my fellow investors and makers!
I have been working on this investment tracker for the past 3+ years. What started as a set of spreadsheets and python scripts has slowly evolved as my daily driver for keeping tabs on my investments across many asset classes.
Of course, I took the time to productize it, but at the end of the day whether I find people who resonate with the product or not, I'm happy to continue refining it. My ultimate goal is to never have to go to other sites or use other means (notes, financial news sites, watchlists, etc.) for keeping tabs on my stocks, crypto, real estate - the total picture.
Feel free to pop on over and give the free trial a spin, love to hear any and all feedback from those who resonate!
The useful bit in one line: point it at a `package-lock.json` / `requirements.txt` / `go.sum` / etc. and it returns the known CVEs, each scored by EPSS (the probability it'll actually be exploited — so you triage the 2 that matter instead of the 40 that don't), plus the fixed version.
Try it in 10 seconds, no signup, no key:
Or wire it into Claude / any MCP client:
then ask it to "scan my package-lock.json."
Boring details: the client is MIT (github.com/novadyne-hq/vulnfeed-mcp, on PyPI as `vulnfeed-mcp`). Scanning is free. Two of the nine tools — detailed single-CVE lookup and continuous project monitoring — are paid; you can pay per call with no account at all (HTTP 402 micropayment) or subscribe, so there's no signup wall just to try it. The hosted backend is closed for now.
I'd genuinely like feedback on three things: (1) what tools are missing that you'd want your agent to have, (2) does per-call vs subscription pricing make sense here, (3) how's the data freshness / any false positives you hit.