cvescout 0.1.0

First public release.

cvescout finds the latest CVEs from live sources instead of a language model's memory, ranks them by patch priority and can alert you about new CVEs in your products.

Highlights

• cvescout feed: recent CVEs from NVD, the CVE List (CVEProject/cvelistV5, about an hour ahead of NVD, no rate limit), GitHub Advisory Database and CISA KEV, with filters for RCE, CVSS, public exploits, products (CPE), keywords and reference links.
• Risk score (--sort risk): critical / high / medium / low from exploitation (KEV, SSVC, PoC), EPSS, CVSS and likely RCE, with the factors behind each rating.
• --url finds CVEs filed under libraries a product bundles, through the product's advisory page (e.g. a Brotli CVE in Node.js).
• cvescout watch: opt-in alerts per product with SQLite state, re-alerts when a CVE's priority rises, optional Slack/Discord/JSON webhook. Nothing runs until you schedule it.
• cvescout mcp: read-only MCP server for Claude Code, Claude Desktop or your own agent; cvescout ask: a Claude agent that must source every CVE from live data.

Tested on Linux, macOS and Windows with Python 3.11 and 3.14. See the README to get started.