FAQ

Does my code get sent to Vulnetix?

No. There is no tool that accepts file content, because the server has no filesystem to use it with. What crosses the wire is a package name, a version, or an advisory id.

The workflows that do read your code run the CLI on your machine and are marked as such.

Do I need the CLI?

Not for 31 tools and 17 of the 33 prompts. The other 16 drive your repository and need it.

Is it free?

There is a free Community tier. All tools and prompts work; exploit, IOC and sighting records and the AI analysis layer need Pro. Counts are available on every tier. Pricing.

Can my whole team share one key?

They can, but quota is metered per organisation and you lose per-user attribution. Teams plans include multiple keys. For CI, use a dedicated service organisation so a pipeline exhausting the quota does not block people mid-task.

What happens when I hit the rate limit?

The tool returns an error result with the reset time and an explicit instruction not to retry, and it is not an HTTP 429, which would make clients retry the whole exchange. See Errors.

Why is the response shorter than the API’s?

Because a raw record is 2.6 MB and no context window holds it. Every tool reduces its response first, keeping every decision field and sampling the enumerations. Response shaping shows exactly what is kept, and _meta["vulnetix/shaping"] reports the ratio on every call.

An exploit list came back empty. No exploits?

Check the count. Records are gated on Community; counts are not. An empty list with exploitCount: 19868 means the detail is withheld, and the response says so in a note.

How current is the data?

The database ingests continuously from 150+ sources. KEV additions typically appear within hours. Responses are edge-cached 5–60 minutes depending on the tool; _meta["vulnetix/upstream"].cached tells you when you got a cached one.

Can I self-host it?

The source is open and it is an ordinary Cloudflare Worker, so yes. You would need a Workers Paid account, and you would still call the Vulnetix API with your own credential. For nearly everyone the hosted endpoint is simpler and identical.

Does it work offline or air-gapped?

No, it is a hosted API. Air-gapped deployment is an Enterprise conversation: sales@vulnetix.com.

Which clients are supported?

Any that can add a remote HTTP MCP server with a custom header. Twelve are documented and verified; several more are expected to work and listed as unverified rather than claimed.

Why does it not use OAuth?

Authentication is an API key today. The RFC 9728 discovery document is published with an empty authorization-server list so one can be added later without breaking already-configured clients. Until then, a client that supports only OAuth cannot connect.

Does it work with self-hosted or enterprise clients?

If the client speaks remote HTTP MCP, yes. Behind a TLS-inspecting proxy you may need to allowlist mcp.vulnetix.com.

Is there a stdio version?

No, and there does not need to be. Clients that can only launch a local command can bridge with mcp-remote. See Other clients, though upgrading the client is better.

How is this different from the Pix plugin?

Pix is a Claude Code plugin with hooks, subagents and capability detection, and it needs the CLI. The MCP server needs nothing and works in every client. They share one database and one credential, and running both is fine.

Can I use it with a local model?

Yes, if your client supports MCP and your model supports tool calling. Small local models often struggle to choose between 31 tools, so disabling the ones you do not need helps.

Does it store my queries?

The server keeps no request logs containing your queries. The API records usage for quota and billing (organisation, route, timestamp, status) as documented in the privacy policy.

Something is wrong. Where do I report it?

GitHub issues for bugs and requests. Security issues go to the security contact in SECURITY.md rather than a public issue.