pwned.coffee: An MCP Server That Lets Coding Agents Check if New CVEs Hit Your Repo
Prodigius2077 · reddit · 2026-10-27
The maker open-sourced pwned.coffee, an hourly-updated security incident list with a read-only MCP server (streamable HTTP, no auth) so coding agents can check whether the latest vulns affect their projects.
Tools include:
- checkrepo / checklockfile: is this repo or lockfile affected?
- lookupcve: one incident by id
- todaysspecials: what's on the board now
- whatsnew / diffsince: incremental polling for agents
Plus two prompts: protectmyrepo and morningcheck. Example: a test package-lock with next 15.5.27 comes back affected (npm install [email protected]); 15.5.28 is fine.
Add to Claude Code: claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp. Not security advice; the vendor advisory wins.
More from coding & agent
- Open-Duet: Self-Hosted Open-Source Alternative to Claude Duet Hits 6.2k Stars — matchaman11 · 2026-10-27
- Agentic AI Costs Are Scaling Faster Than Value—FinOps to the Rescue — DavidLinthicum · 2026-10-27
- Dev claims Claude Opus 5.5 is smarter than every developer he knows — GabGarrett · 2026-10-27
- Consumer AI agents found inside 6 major banks; 77% of users won't grant money-transfer access — focusTrevor · 2026-10-27
- HarborRL open-sources agentic RL: 200+ tasks, 40+ harnesses, one reproducible pipeline — Dear_Treat3688 · 2026-10-27
- Voxel-city demo shows how to prompt Ling-3.1-flash for orbit, zoom, hover and focus interactions — Mrs-Grumpy23 · 2026-10-27