Vulnify: a local CVE knowledge base for AI-driven security workflows
vulnify, developed by Mez 0, consolidates fragmented vulnerability feeds to serve AI-driven security analysis and tooling. The app ingests and enriches CVE records so agents can query a single, authoritative vulnerability source rather than disparate lists. It bundles pre-built databases, a web explorer, and an agent-facing server interface. Security researchers, DevSecOps engineers, and AI developers gain deterministic vulnerability context for building agentic workflows and reducing erroneous agent outputs.
What tasks can the tool actually perform?
The tool assembles a normalized, queryable vulnerability store and enriches CVE entries for downstream use. It merges five authoritative feeds into a single SQLite schema and augments records with metrics and mappings. Sources include:
- CVEProject (cvelistV5)
- NVD (CVSS and CPE)
- CISA KEV
- EPSS scores
- OSV package mappings
How reliable are the outputs for agentic security tasks?
The tool produces deterministic, locally hosted records intended to reduce hallucination when agents query vulnerability data. Enriched fields such as CVSS metrics, KEV status, and EPSS scores provide concrete numeric and status signals that agents can incorporate into decision logic. The included server interface exposes a set of tools specifically designed for agent queries, making programmatic retrieval repeatable rather than conversationally inferred.
What inputs and environment does it require?
The app is Python-based and uses the 'uv' package manager for dependencies, and it requires a local SQLite environment to host the normalized schema. It ships with pre-built databases in releases so teams can start querying immediately, and its ingestion pipeline is resume-safe, allowing interrupted imports to continue without restarting from zero. Continuous update automation keeps records refreshed from the upstream feeds.
Does it fit into existing security workflows and maintenance routines?
The tool includes a Streamlit explorer with about 70 pre-built analytical views for manual inspection and triage, so analysts can blend automated agent queries with human review. Integration expects MCP-compatible platforms for agent orchestration. The developer background in targeted operations suggests the project aligns with offensive and defensive practitioner workflows, and maintenance involves keeping the SQLite store synchronized with source feeds.
A practical choice for teams building agentic vulnerability workflows
The tool is a pragmatic option for security teams and AI developers who require deterministic CVE context for automated agents, especially those with in-house security expertise. Its design assumes operators can manage a local SQLite store and integrate MCP-capable agents, so teams lacking DevSecOps or agent orchestration experience should plan for an initial setup and validation step. Treat outputs as authoritative inputs but validate critical findings through human review.
