Your MCP servers run real code. When was the last time you checked it for CVEs?

说明与用途

mcp-cve-watch 持续监控 MCP 服务器固定依赖的 CVE，建立基线，仅在出现新漏洞时发出警报。

问题

MCP servers run real code via npm or PyPI packages that are never inspected for CVEs, creating a security risk.

结果

mcp-cve-watch provides a lightweight, stdlib-only solution that continuously monitors pinned dependencies for new CVEs, enabling quiet daily checks or strict CI gating.

工作流

• Point mcp-cve-watch at the server manifests (e.g., requirements.txt, package.json).
• Run mcp-cve-watch watch to record a baseline of pinned dependencies.
• Schedule daily runs or use CI gate with --fail-on to exit on new high or worse CVEs.
• Generate reports with mcp-cve-watch report --format markdown or json.
• Adjust flags such as --severity, --include-dev, or --min-severity to filter findings.
• Store state in ~/.config/mcp-cve-watch/state.json for diffing.
• Use cron or CI to automate the process.

证据

Every MCP server on your machine is a running program — npm packages, PyPI packages, daemons with network access.

来源

I built mcp-cve-watch to close that gap: a stdlib-only Python CLI that subscribes your MCP servers' runtime dependencies to a CVE feed.

来源

The first run records a baseline. Every run after that alerts only on new CVEs — quiet enough for a daily cron job, strict enough for a CI gate.

来源

mcp-cve-watch watch ./mcp-servers/requirements.txt ./mcp-servers/package.json # checked 14 pinned dependencies at 2026-10-11 08:52 UTC # *** 2 NEW CVE(s) since last check ***

来源

--fail-on high to exit 3 when a new HIGH-or-worse CVE appears

来源

Only pinned versions can be checked.

来源