Quickstart

1. Get a key

Browser

Sign up free at vulnetix.com/vdb-register and copy the API key from your dashboard. It looks like:

3674ddf9-67cc-4a2d-9b16-a591f6d4412d:6e40f1c324576b65f85dc3c9ff93d31eb65298836b46b540fa18825b47174ce8

Two halves either side of a colon: your organisation UUID, then a 64-character hex digest.

CLI

If you already have the Vulnetix CLI:

vulnetix auth login

That opens a browser, you approve, and the credential is stored. vulnetix auth status shows the organisation and plan.

In your agent

Connect without a key first, then ask your agent to run the vulnetix_auth_start tool. It returns a URL and a short code; you approve in a browser, the agent calls vulnetix_auth_poll, and you get back a ready-formed header value to paste into your config.

A human has to do the approving. There is no endpoint that mints credentials from an email address.

2. Add the server to your client

The shape is the same everywhere: an HTTP MCP server at https://mcp.vulnetix.com/mcp with one Authorization header.

{
  "mcpServers": {
    "vulnetix": {
      "type": "http",
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey <orgId>:<hex>"
      }
    }
  }
}
Warning The header value is ApiKey followed by both halves, <orgId>:<hex>, and not only the hex. Sending only the hex is the most common mistake and produces a 401. If you used vulnetix_auth_poll, it hands you the complete value with the prefix already attached.

Exact file paths and per-client quirks are in the client tutorials. The most common:

Claude Code
claude mcp add, or .mcp.json in the repo.
Cursor
~/.cursor/mcp.json or .cursor/mcp.json.
VS Code / Copilot
.vscode/mcp.json, with inputs for the key.
Claude Desktop
Custom connector, or the config file.

3. Restart and confirm the tools appear

Every client caches the tool list at connect time, so restart it rather than reloading a window. You should see 31 vulnetix_* tools available, plus 33 prompts.

If nothing shows up, Verify your setup has a five-line curl that tells you whether the problem is the server, the network, or the config.

4. Ask something

Start with a question the model cannot answer from memory:

Is CVE-2021-44228 still being actively exploited, and is there a CISA deadline?

The agent calls vulnetix_vuln, and the answer comes back with a KEV due date of 2021-12-24, an EPSS score of 0.99999, an SSVC decision of Act, and 15,259 public proof-of-concept exploits counted across sources.

More things worth asking:

Before I add express to this project, what is its vulnerability history and is there a safe version?

What was added to the CISA KEV catalogue this week, and does any of it affect a Java service?

Give me the remediation plan for GHSA-jfh8-c2jp-5v3q and tell me which action to take first.

Next