Questions, answered plainly.
What crowbar does, what it refuses to do, and what it cannot know.
What does crowbar actually do?
It retrieves vulnerability data and indexes it locally. You point it at a product, a version, a package or a CVE; it pulls the matching rows into a SQLite database that sits next to your codebase, and you query that index from your terminal, your CI or your agent. Every row carries its source.
Is crowbar a scanner?
No. It reads and indexes data. It never touches a host, never opens a socket to a target and never runs downloaded code. It is not permission to test anyone's systems either.
Where does the data come from?
NVD and CVE List v5 for the CVE core, CISA KEV and SSVC for exploitation, EPSS for probability, OSV and GHSA for package advisories, Debian for distributions, MSRC and Apple for vendor advisories, Exploit-DB, Nuclei and Metasploit for proof of concept, plus ATT&CK, CWE and CAPEC for technique and weakness classes.
Each source keeps its own license and provenance in the index.
Do I need an internet connection to use it?
Not to query. Once the index is built, every lookup runs offline against the local database. You need a connection to fetch or refresh the sources.
How big is the index?
It depends on the tier. lite is roughly 150 MB,
medium around 500 MB, heavy about 2 GB,
and extreme pulls in every source. All of them answer
the same commands.
How do I keep it current?
crowbar update re-checks every source and updates what
changed, in about ten seconds.
crowbar update --deep also reindexes the intelligence
tables: Nuclei, Metasploit, ATT&CK and the vendor sources.
Which coding agents can use it?
Any agent that speaks MCP. Crowbar also ships as a plugin and a skill for Claude Code, Codex, Cursor and opencode, so the agent knows which command answers which question instead of guessing.
Does crowbar send my data anywhere?
Queries never leave your machine. The only network traffic is the
download of the upstream sources during sync and
update.
What if my product is not in the index?
Then crowbar has no row for it, which is not the same as “not
affected”. NVD's CPE data is incomplete for some vendors, notably
Apple, so cross-check Windows, iOS and macOS with
crowbar os.
Is it safe to look at the exploit code?
Looking is safe; running is not. crowbar exploit
<id> downloads source for inspection and never executes
it. Treat every exploit as untrusted code and read it in a
disposable VM.