Let your agent check.

Paste one prompt into Claude Code, Codex, Cursor, pi or any agent that can read files. It works out what your project is, reads the lockfiles and checks them against every CVE we know. Your code stays on your machine.

This project

Single repo or monorepo, any language. It finds the manifests itself.

Read https://cve-list.com/agent.md and follow it. Check this project for dependencies and tools with known vulnerabilities from that list. Read only. Don't change anything and don't upload my code. Give me a short report, worst first.

This machine

Your laptop or workstation: global tools, runtimes, editors, images. Not servers. Agents rarely get SSH to those, so run it on the box itself if you want one checked.

Read https://cve-list.com/agent.md and follow it, including the machine scope. Check this laptop for installed tools, packages, runtimes and my projects with known vulnerabilities from that list. Read only. No servers, no SSH, don't upload anything. Give me a short report, worst first.

One CVE

Already read about something nasty? Ask whether you are in it.

Read https://cve-list.com/agent/cve/CVE-2022-40407.md and follow it. Check whether this project is affected by CVE-2022-40407. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

How it works

The agent reads agent.md, a short set of rules and steps.
It looks at your project: monorepo or not, languages, front end, back end, database, containers.
It sends only package names and versions to a lookup that returns every CVE affecting them, any severity. No code, no paths. Prefer to send nothing? It can download the full list and match offline.
You get a short report, worst first: exploited, then likely to be exploited, then the rest. It changes nothing.

What it will not do

Upload your code, lockfiles, file paths or secrets. Package names and versions are the only thing it sends, in a request that is never logged or stored.
Install, upgrade or edit anything. It reports, you decide.
Touch servers over SSH, or read keys, history and password stores.
Treat a failed download as good news. If this site is down it waits, retries and tells you.

For agents and scripts

/agent.md instructions
/agent/cves.csv the list. Parameters: scope=all, q=name, days=90, limit=5000
POST /agent/match complete lookup by package and version
/agent/cve/CVE-2026-12345.md one record
/llms.txt index

The matching is only as good as the agent doing it. A name match without a version check is a lead, not a finding.