Quickstart

1. Get a credential

You need a Vulnetix API key: your organisation UUID and a 64-character hex digest, joined by a colon. Use one of these.

Method	Steps
Console	Sign up at vulnetix.com/vdb-register and copy the API key from the dashboard.
CLI	vulnetix auth login opens a browser sign-in and stores the credential. vulnetix auth status shows the organisation and plan.
Inside the agent	Connect with no header, then ask the agent to run vulnetix_auth_start. Approve in the browser, and vulnetix_auth_poll returns the full header value. See Authentication.

The header value is always:

ApiKey <orgId>:<hex>

2. Add the server

Most JSON clients accept this shape. File locations and per-client key names are on each client page.

{
  "mcpServers": {
    "vulnetix": {
      "type": "http",
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey <orgId>:<hex>"
      }
    }
  }
}

Claude Code takes it as one command:

claude mcp add --scope user --transport http vulnetix https://mcp.vulnetix.com/mcp \
  --header "Authorization: ApiKey ${VULNETIX_ORG}:${VULNETIX_KEY}"

3. Restart and check

Quit and reopen the client. Most read MCP config once at launch. You should see 31 tools and 18 prompts from vulnetix.

Ask the agent:

Run vulnetix_auth_status and tell me which organisation I am connected as.

authenticated: true with your orgId means the header parsed. If it does not, follow Verify your setup.

4. Ask a question

Start with something a model cannot answer from training data:

Is CVE-2021-44228 in the CISA KEV catalogue, what is its EPSS score, and what is the SSVC decision?

The agent calls vulnetix_vuln. Other first questions:

Before I add express to this project, what is its vulnerability history and which version should I pin?
What was added to the KEV catalogue recently, and which entries have a CISA due date in the next 14 days?
Give me the remediation plan for GHSA-jfh8-c2jp-5v3q and say which action to take first.

Next

• Authentication: formats, sign-in from the agent, rotation.
• Plans and limits: what Community withholds and how quota shows.
• Guides: worked sequences for triage, dependency gating and incidents.