crowbarA CVE index inside your codebase
PyPI

Home / Get started

Set up crowbar.

Install the CLI, build a local CVE index and connect it to your coding agent. Three steps, and nothing on your machine changes without your approval.

Install with npx

The setup helper checks your environment, prints the plan and asks before it writes anything. It never installs a runtime you did not approve.

Terminal 
npx crowbar-cli@latest setup

The helper prints the MCP snippet for your agent as well. Read it before you accept.

If Node.js is missing

The setup helper tells you which runtime is missing. Install it with the package manager your system already uses, then run the setup command again.

Windows (PowerShell)

Install Node.js with winget, then confirm the version.

PowerShell 
winget install --exact --id OpenJS.NodeJS.LTS
node --version
macOS

Install Node.js, then confirm it is on your path.

Terminal 
brew install node
node --version
Linux

Install Node.js with your distribution's package manager, then confirm the version.

Terminal 
sudo apt install nodejs npm
node --version

Install with uv

Prefer a Python-native install? The package publishes the CLI and the MCP server on the same distribution.

Terminal 
uvx crowbar-cli@latest setup

Crowbar builds its index with uv, so having it installed is the fastest path to a working setup.

Build the index

The index is a single SQLite file with FTS5. Pick a tier: it decides which sources are fetched, not which commands you can run.

Terminal 
uvx crowbar-cli sync --tier lite
uvx crowbar-cli build --tier lite
~150 MB
lite: KEV, EPSS, recent CVEs, CWE.
~2 GB
heavy: adds Exploit-DB, Nuclei, Metasploit and OSV.
Full
extreme: adds MSRC, Apple and Debian.

A full build needs about twice the index size in free disk space, because it writes a temporary database and swaps it in.

Connect your agent

Crowbar speaks the Model Context Protocol. Any agent that speaks MCP can call it, and crowbar also ships as a skill so the agent knows when and how to use it.

Register the MCP server 
claude mcp add crowbar -- \
  uvx --from crowbar-cli crowbar-mcp

The tool names are prefixed, so they read clearly in a transcript: cb_cve, cb_product, cb_search, cb_exploit, cb_poc and cb_sql.

Verify the setup

These commands report whether the index is built, how fresh it is and where it lives. They are safe to run at any time.

Terminal 
crowbar doctor
crowbar stats --json
crowbar where --json

crowbar doctor exits non-zero when the index is missing or stale. Everything else prints JSON you can pipe into jq.

Keep it fresh

A refresh re-checks every source and updates only what changed. It takes about ten seconds.

Terminal 
crowbar update
crowbar update --deep

The plain refresh covers the CVE tables. --deep also reindexes the intelligence tables: Nuclei, Metasploit, ATT&CK and the vendor sources.

Top