← Back to Discover

Vulert

Scans an uploaded dependency file or SBOM for known vulnerabilities, keeps monitoring it, and can be connected to MCP-compatible coding agents.

Code & secrets security
Visit website ↗

What it does

Vulert is a software composition analysis and vulnerability alert service. You upload a dependency manifest or an SBOM, and it lists the vulnerable packages with severity, background and available fixes. The site says no installation or source-code access is needed, and that results arrive in about 60 seconds. It works with manifests for Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++ and Elixir, plus CycloneDX and SPDX SBOMs. Fixes are matched to the version your app uses, and related issues are grouped into a short list of recommended upgrades. After the first scan, Vulert rechecks your dependencies and emails you when newly disclosed vulnerabilities affect them. For AI coding workflows, Vulert offers an MCP server for Codex, Claude Code, Cursor, VS Code with Copilot and other MCP-compatible agents. The agent can scan the current dependency file and scan again after changes, and the site says it changes dependencies only when you ask. An API and CI/CD integrations are also listed. The site says Vulert supports security and compliance processes with vulnerability records but does not certify compliance on its own.

Capabilities

  • Upload a dependency manifest or SBOM, with no source-code access required
  • Version-specific fix guidance and grouped recommended upgrades
  • Continuous monitoring with hourly checks and email alerts
  • MCP server for connecting coding agents
  • API and CI/CD integrations
  • Support for CycloneDX and SPDX SBOMs

When to use it

  • Checking the open-source dependencies of an app for known vulnerabilities
  • Re-scanning dependencies after an AI coding agent changes them
  • Keeping vulnerability history and reports for security or audit reviews
  • Watching several applications from one place