crowbar MCP server

<!-- mcp-name: io.github.kushvinth/crowbar -->

crowbar

Retrieve CVEs and index them inside your codebase.

Point it at a product and version. It pulls the CVEs that apply and indexes them locally, so any tool in your repo can query the answer.

Website · Guides · Showcases

Quick start · How crowbar works · What you can answer · Showcases · FAQ · Documentation

npx crowbar-cli setup

[!IMPORTANT]

Get crowbar from kushvinth/crowbar,

crowbar.kushvinth.com, or the

crowbar-cli package. A similar

repository name or copied README does not make a download official.

A codebase with no CVE index inside it makes people guess. crowbar is the index: it retrieves NVD, CISA KEV, EPSS, SSVC, the CVE List, Exploit-DB, Nuclei, Metasploit, OSV, Debian, MSRC and Apple advisories, and writes them into a local SQLite + FTS5 database you query from your terminal, your CI or your agent. It is offline and reproducible - the same query gives the same answer, no API, no rate limits - so a lookup costs milliseconds instead of a guess.

No web UI, no daemon, no third-party Python packages. Point it at a product and version and it tells you what is actually exploitable, ranks it by real-world risk, and links the proof-of-concept.

crowbar indexes public exploit and PoC data as data. It never clones,

compiles, or runs it. Treat anything it surfaces as hostile code and detonate

only in a disposable VM. Use it only against systems you own or may test. See

DISCLAIMER.md.

Quick start

Set up your agent

With Node.js and uv installed, run:

npx crowbar-cli setup

Setup finds Claude Code, Codex, Cursor, Gemini CLI and opencode on your machine, shows exactly which configs it will change, and applies them only after you approve. It registers crowbar's MCP server, installs the skill, backs up every config file it edits, and offers to build the local index. Restart your agent afterward. --agents claude,cursor picks agents explicitly; --yes skips the prompts. npx crowbar-cli setup --remove undoes it the same way: it lists what it will remove, asks first, and leaves your other servers and the index alone.

Or install the Claude Code plugin

One install drops in a skill and an MCP server:

claude plugin marketplace add kushvinth/crowbar
claude plugin install crowbar@crowbar

Your agent now has:

Shortened. The full README is on GitHub.