VulnFeed

Scan a lockfile for known vulnerabilities. Reads a package lockfile (package-lock.json, requirements.txt, go.sum), queries NVD + GitHub Advisories, enriches with EPSS exploit probability, and returns a prioritized vulnerability report with fix recommendations. By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9). Set show_all=True to see every vulnerability. Args: lockfile_path: Absolute path to the lockfile to scan. show_all: Show all vulnerabilities including low-priority ones.

Check a single package for known vulnerabilities. Args: name: Package name (e.g. "express", "django", "golang.org/x/net"). version: Package version (e.g. "4.18.2", "3.2.0"). ecosystem: Package ecosystem — "npm", "PyPI", "Go", "crates.io", "RubyGems", or "Packagist". Defaults to "npm". show_all: Show all vulnerabilities including low-priority ones.

Look up detailed information about a specific vulnerability. Returns full details including severity, EPSS exploit probability, affected packages, fix versions, and references. Args: cve_id: Vulnerability ID (e.g. "CVE-2024-29041", "GHSA-rv95-896h-c2vc").

Auto-detect and scan all lockfiles in a project directory. Walks the project directory looking for lockfiles (package-lock.json, requirements.txt, go.sum, etc.) and scans each one. Skips node_modules, .git, and vendor directories. By default, suppresses low-priority CVEs (EPSS < 10% and CVSS < 9). Args: project_path: Path to the project root. Defaults to current directory. show_all: Show all vulnerabilities including low-priority ones.

Register a project for continuous vulnerability monitoring. Scans the project's lockfiles, records the current vulnerability baseline, and stores a snapshot. Use check_alerts later to see new vulnerabilities that appeared since registration. With webhook_url set, VulnFeed re-scans the project on a schedule (hourly on the paid tier, daily on the free tier) and POSTs any NEW findings to that URL as JSON, signed with HMAC-SHA256 in the X-VulnFeed-Signature header using the webhook_secret returned here — once. Without it, monitoring is pull-only: nothing happens until check_alerts is called. Args: project_path: Path to the project root. Defaults to current directory. project_name: Human-readable name for the project. Defaults to directory name. webhook_url: Optional https URL to receive new findings (CI hook, Slack/Discord relay, your own endpoint). Must be a public https hostname. Requires VULNFEED_API_KEY (webhooks are a paid feature).

Set, rotate or remove the webhook for a monitored project. Setting a URL (even the same one) mints a NEW signing secret and returns it once. Passing an empty webhook_url removes the webhook; monitoring continues pull-only via check_alerts. Args: project_id: Project ID from monitor_project / list_monitored. webhook_url: https URL to receive new findings, or "" to remove.

Check for new vulnerabilities since the last scan of a monitored project. Compares current vulnerability data against the stored baseline. Returns new vulnerabilities (not seen before) and resolved ones (previously known, no longer present). Args: project_id: The project ID returned by monitor_project.

List all projects registered for vulnerability monitoring. Shows project names, IDs, package counts, and registration dates.

Update a monitored project's dependency snapshot after upgrading packages. Re-reads lockfiles from the project directory and updates the stored dependency list. Preserves vulnerability history: existing known vulns that still apply are kept; new vulns from upgraded deps are flagged; vulns from removed deps are marked resolved. Args: project_id: The project ID to update. project_path: Path to the project root. Defaults to current directory.

Remove a project from vulnerability monitoring. Deletes the stored dependency snapshot and vulnerability baseline. Args: project_id: The project ID to remove.