Retrieve CVEs. Index them locally.

Stop guessing
at CVEs.

Point crowbar at your stack. It pulls the CVEs that apply, indexes them locally, and hands your codebase a database you can query while you work. No API calls, no rate limits.

Get started See a real triage ↓

Showcase → for real triage sessions, step by step.

Guides → for CLI, MCP and index workflows.

Set up crowbar

Copy this into your coding agent:

Your coding agent

Install crowbar and connect it to this coding agent using npx crowbar-cli@latest setup. Show me the setup plan for approval, then verify the installation.

Or run this in your terminal:

npx crowbar-cli@latest setup

Approve the setup plan, then restart your agent.

Other install options: uvx →

First time, or missing Node.js or a coding agent? Follow the step-by-step setup guide →

How it works

Vulnerability intelligence means knowing which vulnerabilities apply to what you actually run. Crowbar retrieves that data and indexes it locally, so your codebase can query it instead of guessing.

Point at your stack

Give crowbar a product, a version and a question.
Crowbar retrieves and indexes

It pulls real CPE ranges, KEV and EPSS scores, advisories and proof-of-concept metadata into a local database.
Query it from your codebase

You ask for the CVEs that apply, and crowbar answers from the index it just built.

See the difference between recall and lookup

Which CVEs affect nginx 1.18.0?

Recall from memory

What an agent usually answers

I'm not certain, but nginx has had a few CVEs
around that version. You might want to check
CVE-2021-23017 and possibly some others.

I'd also run a scan and read the changelog to be
sure.

Uncertain, unverifiable, and impossible to act on.

Look it up with crowbar

Example prompt · nginx

Use crowbar to index the CVEs that affect nginx 1.18.0, and tell me what to upgrade to.

Example answer · based on the findings

Two CVEs affect that version. CVE-2021-23017 is the one to patch. It matched the range f5:nginx >=0.6.18 <1.20.1.

matched f5:nginx >=0.6.18 <1.20.1Upgrade to nginx 1.20.1 or later

crowbar returns: The matched range, the severity, the exploitation signal and the fix version.
You get: Which row to act on, what to upgrade to, and that the rest of the index does not apply to your version.

One question, two answers. The second one names a version to upgrade to.

Two questions your agent gets wrong every day: is this CVE real? and does it affect us?

Example 01 · CVE triage

Is Log4Shell worth patching?

You ask crowbar about CVE-2021-44228. It returns the record, the risk signals and the proof-of-concept code that already exists, so the answer is a decision and not a recap of a blog post.

1. Ask about the CVE

Example prompt · Log4Shell

Use crowbar to triage CVE-2021-44228. Is it being exploited in the wild, how likely is it, and is there public proof-of-concept code?

2. Read the signals

Crowbar ranks the signals before the score. A CVSS number alone is not a risk verdict.

Is it exploited?: CISA KEV and SSVC exploitation state. KEV · ssvc=active
How likely?: EPSS, the 30-day exploitation probability. epss 1.00
What is the impact?: CVSS, only once the other signals are known. CRIT 10.0

3. Get the decision

crowbar answers with the fix, the evidence and the exploit code, then tells you what it cannot know.

crowbar · CVE-2021-44228 truncated

CVE-2021-44228  CRIT 10.0  KEV  epss 1.00  ssvc=active
affects  apache:log4j >=2.0.1 <2.3.1, >=2.13.0 <2.15.0
KEV  added 2021-12-10  ransomware=Known
Exploit-DB (3)   Nuclei (44)   Metasploit (4)   PoC repos (2)

exploited in the wild · patch nowUpgrade to log4j 2.17.1 or later

KEV is the strongest signal here, so it leads the answer.

See the real crowbar output for CVE-2021-44228

Recorded from a local index. Crowbar never calls an API and never answers from memory.

crowbar · live triage Source

See how each signal is read, one step at a time

Which number decides the answer for CVE-2021-44228?

Read the record in the order crowbar ranks it

crowbar · selected fields

CVE-2021-44228  CRIT 10.0
  KEV  added 2021-12-10  ransomware=Known
  ssvc  exploitation=active
  epss  1.00  (30-day probability)
  epss_pct  99.9%
  cvss  10.0  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

01 · Is it exploited?

“It is in CISA KEV and SSVC says active. Someone is already doing it.”

Check the exploitation signals before anything else.

KEV: Listed
ransomware: Known

02 · How likely?

“EPSS 1.00 means exploitation is expected, not merely possible.”

EPSS is a model estimate, so report it as probability.

epss: 1.00
window: 30 days

03 · What is the impact?

“CVSS 10.0 says what happens if it lands. It never decides the priority.”

Name the fix and the version that carries it.

fixed in 2.17.1+

KEV ≫ SSVC ≫ EPSS ≫ CVSS

Your agent reads the signals in order, then names the version that fixes it.

Field selection from a crowbar CVE record. The ordering is the point: exploitation, then likelihood, then impact.

Example 02 · Version matching

Which nginx CVEs affect 1.18.0?

Searching a product name returns everything that mentions nginx. Crowbar tests the version against the real CPE ranges, so the answer is the small list you actually have to act on.

1. Ask about the version

Example prompt · nginx

We run nginx 1.18.0 in production. Use crowbar to find the CVEs that actually affect that version, and tell me what to upgrade to.

2. Only true hits

Every returned row carries the range that matched, so the agent can show its work instead of asserting a fact.

NVD CPE data is incomplete for some vendors. Cross-check with crowbar os for Windows, iOS and macOS.

3. Compare the two answers

Same product, two very different lists. One is a keyword hit, the other is an applicability answer.

By product name

$ crowbar search --product nginx

412 CVEs mention nginx
nginx 1.14.0  CRIT 7.5
nginx 1.17.0  HIGH 6.1
nginx 1.20.0  MED  4.3
… every version in the index

By version · matched ranges

$ crowbar product nginx --version 1.18.0

2 real hits (version-matched)
CVE-2021-23017  HIGH 7.7  epss 0.53
  matched f5:nginx >=0.6.18 <1.20.1
  resolver off-by-one, attacker-forged UDP
  can corrupt memory

Read the version-matching guide →

See what happens between the question and the answer

From question to patch

01 · crowbar matchesTest the version against CPE rangesExact versions, start bounds and end bounds are all checked against the NVD CPE data.
02 · Your agent readsRanks what matchedKEV first, then SSVC, then EPSS, then CVSS. The matched range travels with each row.
03 · You patchUpgrade to a safe versionThe answer names the fixed version instead of saying “update to the latest”.

One index. Every source.

Crowbar builds a local SQLite index from the sources that matter and keeps them current with a cheap refresh.

Showcase →

CVE core

NVD, KEV, EPSS and SSVC

Descriptions, CVSS vectors, confirmed exploitation, 30-day probability and the SSVC exploitation decision: the four signals that rank a CVE.

Read the triage case

Ecosystems & vendors

OSV, Debian, MSRC and Apple

Package advisories with fixed versions, distribution trackers, and Windows, iOS and macOS advisories normalized into one table.

Read the ecosystem case

Proof of concept

Exploit-DB, Nuclei and Metasploit

Searchable by CVE or by code. Sources are downloaded for inspection and never executed.

Read the PoC case

Your first triage

Try crowbar on a real product.

Walk through a complete triage, from the first question to the version you have to upgrade to.

Read the case studies

Choose your question.

These guides cover setup and the lookups you reach for most.

Triage a CVE

Read the record in the right order: exploitation first, then likelihood, then impact, then the fix.

CVE triage guide

Match a version

Test the version you run against the real CPE ranges and get back only the hits that apply.

Version matching guide

Find the proof of concept

Search exploit code by CVE, by description or by a fragment of the code itself.

Proof-of-concept guide

Try a bigger question

Example prompt · Fleet

Use crowbar to audit the versions in our deployment manifest and list every CVE that applies, ordered by risk.

One query per product and version.

Example prompt · Dependency

Use crowbar to check every dependency in package-lock.json against the advisories, and tell me which versions are safe.

See the lodash case study →

Install

Pick your size.

The setup helper checks for uv, prints the index build command and the MCP snippet for your agent. It never edits your configs without showing you the plan.

Read the setup guide

Index tiers. Every tier ships the same commands; larger tiers only add sources.
Tier	Size	Includes
`lite`	~50 MB	KEV, EPSS, recent CVEs, CWE
`medium`	~500 MB	Full NVD, CAPEC, SSVC, ATT&CK
`heavy`	~2 GB	Exploit-DB, Nuclei, Metasploit, OSV
`extreme`	Full corpus	MSRC, Apple, Debian, every source

Reference data, not a weapon.

Crowbar looks things up. It is not a scanner, and it is not permission to test anyone's systems.

Authorization first.

Only test hosts you own or are permitted to test. Crowbar answers questions; it does not touch anything.
Exploits are untrusted code.

crowbar exploit <id> downloads source for inspection. It never runs it. Use a disposable VM.
KEV and SSVC describe elsewhere.

They mean exploitation was observed in the wild, not that your host is affected.
Absence is not safety.

EPSS is a model estimate, and a missing row is not proof of “not affected”.

Any questions?

Read the FAQ for setup and common questions.

GitHub issues to report a bug or request a feature.

Follow the setup guide to install, build the index and connect your agent.

Stop guessingat CVEs.