Show HN: I built a local-first CVE triage app in Rust

Know which vulnerabilities matter, and what to do about them.

A private desktop app for vulnerability triage and scanning, written in native Rust, with a CLI, REST API and MCP server for developers and AI agents.

41 MCP tools, 40 data sources, SBOMs in and out, on-device AI.

What it is · Getting started · Features · Install · Local AI · Data sources · Developer notes · Citing

Sped-up demo on macOS (1080p video): the threat landscape, triage and recording a decision, the decision ledger, a scan with attack chains and an SBOM, and the watchlist.

Every known software vulnerability gets a public ID, such as CVE-2024-3400. For each one, security, IT and development teams face the same question: does this affect us, and do we fix it now or can it wait? Answering it usually means checking NVD, CISA, FIRST, GitHub and vendor advisories by hand, one browser tab at a time.

CVE publication keeps rising (48,185 in 2025, 20.6% more than 2024, and over 86,000 by 27 October 2026), and in April 2026 NIST said the National Vulnerability Database cannot keep up, so it will enrich CVEs in CISA's Known Exploited Vulnerabilities (KEV) catalog, federal-use software and critical software first, and move its unenriched backlog from before 1 March 2026 to "Not Scheduled". Meanwhile, Mandiant's M-Trends 2026 estimates the mean time to exploit at −7 days, so exploitation routinely begins before a patch is released, and exploits were the most common initial infection vector for the sixth year running (32% of intrusions).

Give CVE Intel a CVE ID, a project folder, a lockfile or SBOM, a container image, the software on this computer, your own domains, or a suspicious IP address, file hash or domain. It queries up to 40 public sources, including CISA KEV, FIRST's EPSS and ENISA's EU Vulnerability Database alongside NVD, and returns what the vulnerability is, a risk score from 0 to 100, whether attackers are already using it, the evidence behind each signal and what to do next. It also shows what changed this week across those sources, and watches the vendors, products and packages you run.

It is for security analysts, IT and operations teams, developers checking their dependencies, and anyone learning vulnerability management.

Decide whether to patch now. Enter a CVE ID and get a risk score from 0 to 100, a plain recommendation and how urgent it is, with the evidence behind it.

Put a list of vulnerabilities in order. Paste up to 10 CVE IDs from a scanner report and get the order to patch them in.

Check your project's dependencies. Drop a project folder on the window, or paste a lockfile or SBOM. You see which packages have known vulnerabilities, ranked by how likely they are to hurt you (Log4Shell first, not just the highest CVSS), and which version fixes them. Scan again later to see what is new, fixed or riskier since last time, or save the scan as a CycloneDX SBOM with the findings in it.

Check what you run and ship. Scan the apps and operating system on this computer, or a container image you build (no Docker needed). Or see what public sources already know about your own domains and servers, without CVE Intel ever connecting to them.

See what affects the products you run. List the known vulnerabilities for a product and version, such as Apache Tomcat 9.0.80, with actively exploited ones first.

See what changed this week. Open Landscape for new CISA KEV entries, CVEs ENISA marks exploited that KEV does not list yet, rising EPSS scores, new Metasploit modules and PoCs, new critical CVEs, Project Zero's in-the-wild zero-days and the latest CISA advisories. CVEs that several sources agree on are listed first.

Watch the products you run. Add a vendor, product, package or CVE to the local watchlist. Each refresh records what changed: new CVEs, KEV listings, EPSS jumps, new exploits, CVSS revisions and newly available fixes.

Remember what you decided, and hear when the reasons change. Record a decision on a CVE (patch now, defer until a date, accept the risk, not affected, mitigated) with the assumptions it rests on. Every refresh re-checks them: a deferral turns stale the day the CVE enters CISA KEV or an exploit appears, and the ledger tells you how your past calls held up.

Keep an eye on what attackers are exploiting. Filter CISA's catalog of actively exploited vulnerabilities by vendor, product, ransomware use or date.

Investigate something suspicious. Check an IP address from your logs, a file hash your antivirus flagged, or an unfamiliar domain or URL against threat-intelligence sources.

Ask questions in plain English. "Should we patch CVE-2024-3400 this weekend?" The AI assistant looks up the facts first, then explains them, and shows which sources it used.

Give AI coding assistants the same knowledge. Claude Code, Cursor, VS Code and other tools can use CVE Intel while they work, through MCP.

Terms you'll see

Term What it means

CVE A public ID for one known vulnerability, such as CVE-2021-44228 (Log4Shell).

CVSS A 0–10 severity score: how bad the flaw is if someone exploits it. It says nothing about how likely an attack is.

EPSS The probability that a vulnerability will be exploited in the next 30 days, published daily by FIRST.

CISA KEV The US government's catalog of vulnerabilities known to be exploited by attackers. A CVE on this list is urgent.

ENISA EUVD The EU vulnerability database. Its own "exploited" flag is independent of CISA KEV and can raise the SSVC Exploitation input.

Exploit / PoC Public code that demonstrates or carries out an attack. A Metasploit module means the attack is packaged and easy to use.

SSVC A decision method from CISA and CERT/CC that ends in one of four actions: Act, Attend, Track* or Track.

SBOM / lockfile A list of every package your software uses, with exact versions.

MCP Model Context Protocol, the standard way AI assistants call outside tools.

The risk score combines these signals: severity (CVSS), the chance of exploitation (EPSS), confirmed exploitation (CISA KEV) and public exploit code. Anything on CISA KEV is always CRITICAL. See Risk score for the formula.

CVE Intel helps you decide what to patch. It does not probe, port-scan or attack anything, and it does not apply fixes. Scans read what is already on your machine (dependency files, the software installed on this computer, a container image you choose) and send only package and product names and versions to OSV.dev and NVD. The exposure check is passive: it asks public sources (Shodan, certificate transparency logs) what they already know about domains and addresses you own, and sends nothing to them. Results are only as current as the public sources.

You don't need an account or any API keys to start. Most people are looking at their first result within a couple of minutes:

The buttons at the bottom of the sidebar switch between the light and dark themes and make the text larger or smaller. The version you are running is shown below them.

Everything up to Developer notes is about the desktop app. To use CVE Intel from a terminal, a script, a CI pipeline or another program, go straight to that section.

Threat landscape

What changed recently, from several independent sources at once: new CISA KEV entries (with ransomware flags and vendor counts), CVEs ENISA EUVD marks exploited that CISA KEV does not list, the largest EPSS rises, new or updated Metasploit modules and PoC-in-GitHub repositories, newly published critical NVD CVEs, Project Zero's in-the-wild zero-days and the latest CISA advisories. Each panel names its source and when it was fetched, and the ⓘ on each tile explains what it counts. Your watchlist comes first, then the CVEs that appear in two or more panels. Each watched item is a chip that opens it in the Watchlist. Copy the briefing as Markdown for a ticket or weekly note. Ask "What's new this week?" in Ask AI for the same briefing.

Watch the vendors, products, packages and CVEs you run. Each refresh compares them with the last check and records what changed: new CVEs, KEV listings, ransomware use, EPSS jumps, new exploits or Metasploit modules, CVSS changes, newly available fixes and ENISA exploitation reports. The first check of an item records a silent baseline. The list lives only on this machine (~/.cve-intel/watch.db, owner-only). While the app is open it can refresh on a schedule (every 6 hours by default; change or turn it off in Settings). AI agents can read the watchlist over MCP but cannot change it.

Every tool says what is risky. None remembers what you decided, why, and whether the reasons still hold. Decisions does. Press Record decision on a triage result, a scan finding or a comparison, choose a verdict (patch now, defer until a date, accept the risk, not affected, mitigated) and tick the assumptions it rests on. The machine-checked ones are pre-ticked from today's evidence: not in CISA KEV, EPSS below a threshold, no public exploit, no Metasploit module, local access only, needs privileges, needs user interaction, no fix yet, not marked exploited by ENISA, no ransomware use, CVSS below a threshold, the sources agree, NVD has not analysed it yet. The manual ones (not internet-facing, behind a WAF, a compensating control, not reachable, the vendor says not affected, or your own words) carry a review date.

Recording a decision adds the CVE to the watchlist, and every refresh re-checks the assumptions. The day the CVE enters KEV, EPSS crosses the threshold, an exploit or a fix appears, or NVD publishes its analysis, the decision turns stale with the exact reason, an event lands in the watchlist feed, and the Landscape counts it under Decisions to revisit. A deferral past its date is expired; a manual assumption past its review date is review due. Re-decide replaces a decision and keeps the old one as history; Close records whether it was patched, accepted for good, won't be fixed, or other.

The ledger also tells you how your judgment held up: of the CVEs you held back in the last 30, 90 or 365 days, how many later entered KEV, gained an exploit or rose in EPSS, and how many days after the decision; of the patch-now calls, how many were confirmed by KEV, an exploit or a high EPSS at the time or since. Export the ledger as OpenVEX or CycloneDX VEX for scanners and SBOM consumers (the CycloneDX document lists each decided-on package as a component, so its references resolve in Dependency-Track and the like). It lives only on this machine (~/.cve-intel/decisions.db, owner-only); AI agents can read it over MCP (list_decisions, get_decision_calibration) but never change it, and Ask AI mentions your decision when you ask about a CVE you decided on. From the terminal: cve-intel decide record CVE-2025-12345 --verdict defer --until 2026-12-31 --auto, then decide list, decide check, decide calibration and decide export.

One lookup across NVD, CVE.org, EPSS, CISA KEV, ENISA EUVD and public exploit sources. The result includes the risk score, a plain recommendation and urgency, and the evidence behind it: CVSS (and where it came from), 30-day EPSS probability and its recent trend, KEV dates, ENISA's exploited flag, CIRCL sightings (deep triage), and the exploit evidence found in Metasploit, Exploit-DB, Nuclei, GitHub, PoC-in-GitHub and, with a VulnCheck token, VulnCheck KEV and XDB. When NVD has not scored a CVE yet, the CNA's or CISA's score from the CVE.org record is used. Deep triage also returns a CISA SSVC decision, using CISA's own published SSVC assessment (Vulnrichment) where one exists. ENISA EUVD or VulnCheck KEV can raise SSVC Exploitation to active; they do not change the risk score.

Who says what. Every triage result also lays the sources side by side: NVD's own score and analysis status, the CNA's score, CISA's ADP (Vulnrichment) score and SSVC assessment, EPSS, CISA KEV, ENISA EUVD, VulnCheck KEV and, in deep triage, Microsoft, Red Hat and Ubuntu (press Check vendors on a standard triage to add them). It names where the