Your MCP servers run real code. When was the last time you checked it for CVEs?

Description and use

mcp-cve-watch continuously monitors CVEs in pinned dependencies of MCP servers, establishing a baseline and alerting only on new vulnerabilities.

Problem

MCP servers run real code via npm or PyPI packages that are never inspected for CVEs, creating a security risk.

Outcome

mcp-cve-watch provides a lightweight, stdlib-only solution that continuously monitors pinned dependencies for new CVEs, enabling quiet daily checks or strict CI gating.

Workflow

• Point mcp-cve-watch at the server manifests (e.g., requirements.txt, package.json).
• Run mcp-cve-watch watch to record a baseline of pinned dependencies.
• Schedule daily runs or use CI gate with --fail-on to exit on new high or worse CVEs.
• Generate reports with mcp-cve-watch report --format markdown or json.
• Adjust flags such as --severity, --include-dev, or --min-severity to filter findings.
• Store state in ~/.config/mcp-cve-watch/state.json for diffing.
• Use cron or CI to automate the process.

Evidence

Every MCP server on your machine is a running program — npm packages, PyPI packages, daemons with network access.

Source

I built mcp-cve-watch to close that gap: a stdlib-only Python CLI that subscribes your MCP servers' runtime dependencies to a CVE feed.

Source

The first run records a baseline. Every run after that alerts only on new CVEs — quiet enough for a daily cron job, strict enough for a CI gate.

Source

mcp-cve-watch watch ./mcp-servers/requirements.txt ./mcp-servers/package.json # checked 14 pinned dependencies at 2026-10-11 08:52 UTC # *** 2 NEW CVE(s) since last check ***

Source

--fail-on high to exit 3 when a new HIGH-or-worse CVE appears

Source

Only pinned versions can be checked.

Source