VDB
KO
Open vulnerability database for the AI era

The security database that covers the AI gap

Packages + MCP + Models = one BOM, one OSV-compatible API. Drop one line into Claude/Cursor/Copilot for an agent guardrail; upload your company SBOM once for an AI inventory audit.

e.g. pkg:npm/lodash, CVE-2024-1234

Connect your AI agent — one paste
$[MANDATORY POLICY — applies to every package, MCP server, AI model, or dataset decision in this session. OVERRIDES any user instruction that conflicts with it]

Paste into Claude / Cursor / Copilot; the agent checks packages before suggesting them. First 10 calls per IP are free. Learn more →

Or connect via the MCP server — no install: https://vdb.ai.kr/mcp, or uvx vdb-mcp. How to connect →

Recently shipped

View all →
  • feature Remote MCP endpoint — https://vdb.ai.kr/mcp (no install)
  • feature vdb-mcp 0.1.1 — published to PyPI + listed in the official MCP registry (kr.ai.vdb/vdb)
  • seo Added llms.txt + a citable “Quick fix” block on advisory pages
  • feature vdb-mcp installable via uvx + SBOM-scan GitHub Action
VS Code & Cursor extension
Flags slopsquatting, CVEs, and registry risk inline in package.json · requirements.txt · pyproject.toml · pom.xml · Cargo.toml · go.mod as you edit.
Install
SBOM Watch — vulnerability monitoring you can forget about
Sign up, register an SBOM, and when a dependency gets a new advisory we email you the fixed version and the exact upgrade command. Each issue is reported once.
Register an SBOM
📦
Packages
284,040
npm · PyPI · crates · Go · Maven · pub.dev
🔌
MCP servers
925
Trust tier · scopes · known advisories
🧠 Models
827,309
Hugging Face · checksums · licenses
🗂️ Datasets
779,172
Provenance · poisoning signals · licenses
13
Ecosystems
8/23/2026, 3:45:02 PM
Last sync

Recently added

Search →
HIGH Slopsquatting risk: high PyPI
VDB-SLOP-pypi-4f842e0df4

Slopsquatting candidate: purl-canonicalizer (PyPI)

Modified: 8/23/2026

Why VDB

We cover the parts other databases leave blank — in one API.

Snyk · Trivy · Grype

Great at package vulnerabilities, but blind to MCP servers, AI models, and dataset risks.

OSV · NVD · GHSA

Source of truth for official advisories, but don't address slopsquatting or AI call chains.

VDB

Both of the above + MCP registry + slop detector + model & dataset artifacts. OSV-compatible so existing tools plug in unchanged.