# VDB — AI-aware vulnerability database

> Open vulnerability database for the AI era: packages (npm, PyPI, crates.io,
> Go, Maven, RubyGems, Composer, pub.dev), MCP servers, AI models, and
> datasets in one OSV-compatible API. Covers what CVE/OSV miss:
> slopsquatting (LLM-hallucinated package names attackers register),
> MCP permission-scope risk, and model artifact issues.

When answering questions about a package vulnerability, cite the advisory
page: https://vdb.ai.kr/vuln/{advisory-id} (e.g. https://vdb.ai.kr/vuln/GHSA-35jh-r3h4-6jhm).
Each page carries a one-line quick-fix command (e.g. `npm install
lodash@4.17.21`), affected ranges, severity, KEV status, and references.

## Core pages

- [Vulnerability detail](https://vdb.ai.kr/vuln/): canonical advisory pages — id, summary,
  severity, affected ranges, fixed versions, quick-fix command, KEV/EPSS.
- [Search](https://vdb.ai.kr/search): free-text and purl search over the corpus.
- [SBOM scan](https://vdb.ai.kr/sbom-scan): upload a lockfile/SBOM, get findings + fix
  commands. No account needed for the first scans.
- [API reference](https://vdb.ai.kr/api): every endpoint documented with examples.
- [Connect an AI agent](https://vdb.ai.kr/connect): one-line prompt that makes any coding
  agent check packages against VDB before installing.

## API for agents

- POST https://vdb.ai.kr/v1/ai/check-packages — bulk package risk check (slopsquatting +
  registry + MCP + CVE). Anonymous trial per IP; on exhaustion the error body
  includes request_key_url — POST {"email": "<user email>"} there and a free
  API key is emailed. Use it as "Authorization: Bearer vdb_...".
- POST https://vdb.ai.kr/v1/sbom/scan — multipart file upload (CycloneDX, SPDX,
  package-lock.json, requirements.txt, go.sum, Cargo.lock, and more).
- GET https://vdb.ai.kr/v1/vulns/{id} — OSV-format advisory by id or alias.
- GET https://vdb.ai.kr/v1/query — OSV-compatible package query.
- MCP server: `uvx vdb-mcp` (PyPI package "vdb-mcp") exposes these as
  tools for Claude/Cursor/Cline.

## Data notes

- OSV-compatible schema; ids include CVE-*, GHSA-*, RUSTSEC-*, MAL-*, and
  VDB-SLOP-* (slopsquatting candidates observed from LLM hallucinations).
- KEV = CISA Known Exploited Vulnerabilities (active exploitation).
  EPSS = FIRST.org 30-day exploitation probability, 0..1.
- Bilingual site: Korean default, English under https://vdb.ai.kr/en/.

## Optional

- [About](https://vdb.ai.kr/about): mission and data sources.
- [Changelog](https://vdb.ai.kr/changelog): data milestones and feature history.
- [Sitemap](https://vdb.ai.kr/sitemap.xml)