Python SDK 4.0 with an MCP server, Smart Audit beta and Watchlist alerts

Released July 31, 2026

Python SDK 4.0 ships an optional MCP server that Claude Code, Cursor and other MCP clients can run locally, and the Vulners connector joined the official OpenCTI connectors. Smart Audit (beta) takes software names as people write them. Watchlist emails you when a bulletin you follow changes.

Python SDK 4.0 with an MCP server

Version 4.0 of the vulners package was released on July 24. It has a fully typed data model and two clients, Vulners and AsyncVulners, with identical methods. The optional MCP server runs locally under any MCP client, including Claude Code, Claude Desktop, Cursor and VS Code, and its seven tools cover bulletin and exploit search, CVE lookup, and software, Linux and Smart audits. Code written for 3.x keeps working.

pip install -U "vulners[mcp]"
export VULNERS_API_KEY=YOUR_API_KEY_HERE
vulners-mcp

Docs: Python SDK

Vulners in OpenCTI

The Vulners connector is in the official OpenCTI connectors repository, marked Filigran Verified. It enriches OpenCTI Vulnerability entities with CVSS v2, v3 and v4 scores, EPSS, CISA KEV status, links to public exploits and proof-of-concept code, and the affected software and products. The STIX 2.1 bundle is built on the Vulners side, so the connector itself stays thin. Source and setup: OpenCTI-Platform/connectors.

Smart Audit (beta)

Software inventories rarely contain clean CPEs. Smart Audit takes strings as they come, such as “Adobe Reader 5.3” or “nginx 1.14 on windows”, and finds the CPE behind each one before looking up vulnerabilities. For “nginx 1.14 on windows” it settles on the F5 nginx 1.14 CPE with Windows as the target platform. It accepts up to 500 strings per request, each up to 512 characters, and matches them against the NVD CPE dictionary plus the CPEs Vulners builds for OS packages, language libraries and niche vendors. The endpoint is in beta, and its format may still change.

curl -X POST https://vulners.com/api/v4/audit/smart \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"software": ["Adobe Reader 5.3", "nginx 1.14 on windows"]}'

Docs: Smart Audit

Watchlist

Bookmark a bulletin from its page or from search results and it goes to your Watchlist. With a bulletin bookmarked, “Manage alerts” on its page turns on email alerts for the Watchlist, sent hourly, every 6 hours or daily. An alert goes out when a tracked bulletin’s severity band changes or it becomes exploited in the wild. Edits to the title or description trigger one too.

Discovery files for AI agents

Vulners serves an API catalog at /.well-known/api-catalog (RFC 9727), an agent skills index and /auth.md, which explains how an agent authenticates. In browsers with WebMCP support, the site exposes search and bulletin lookup as tools.

Sources and data

HPE security bulletins are a new source, and Microsoft (MSRC) records include impact, exploitability, CWE, mitigations and FAQ.