01
Install our GitHub App
Connect the repositories you ship from. We read your package manifests and lockfiles so we know which versions of which dependencies you actually use.
Register
Hundreds of CVEs ship every week. Almost none of them are about you, until one is. Install our GitHub app on your repos and our sensor on your servers and we know exactly what you run everywhere, and exactly what's vulnerable.
Your coding agent and our MCP server help you switch on unattended upgrades, auto-merged dependency bumps, and scheduled reboots that clear the everyday CVEs on their own.
Then we monitor those automations to ensure that they are actually doing their job, and pull you in only when something drifts or a CVE genuinely needs a human.
CVEs and security newsletters aren't all that useful if you don't know what you're actually running. OurCVEs takes a full inventory of everything in your stack and makes it available to your coding agent via an MCP server.
Your agent, armed with our tools, will guide you through hardening every repository and server. It will help you set up industry-standard tools and best practices to automatically patch vulnerabilities as they arise and deploy those patches safely.
Once you are automating as much of your security posture as possible, we keep an eye on those automations to ensure that they are working as expected and are sufficient to keep you safe.
When something does need your attention, we notify you and your coding agent can use our MCP server to help you get things back on track quickly.
Connect the repositories you ship from. We read your package manifests and lockfiles so we know which versions of which dependencies you actually use.
Install the OurCVEs sensor on the boxes you run in production so that we can match what you are running on your server with notices as they come in.
Our MCP guides your coding agent through creating and implementing a plan to keep your entire ecosystem secure with as little ongoing attention from you as possible.
We monitor your automations to ensure that the plan is working. If your posture starts to slip or a serious, imminent threat requires your immediate attention, we let you know.
Once we can see your whole stack, every new advisory gets sorted the moment it lands.
The vast majority of identified vulnerabilities can be patched automatically using industry-standard tools like Dependabot and your server OS's automatic patch and reboot features. We make sure those automations are set up and working, and let them handle the bulk of the work.
No agent to run. No cron job to babysit.
Occasionally, a severe vulnerability without an available patch might put your organization at immediate risk. Sometimes, one of your automations might break down and routine vulnerabilities start to linger longer than they should. When this happens, we send you an alert with a prompt to help your agent guide you to an immediate fix.
Not another inbox full of noise.
Automations drift. Someone disables unattended upgrades to chase a bug, an OS slips past end-of-life, a box sits waiting on a reboot, Dependabot quietly stops merging. We continuously check what's actually running against the posture you declared and flag the moment something slips — that ongoing watch is the real work. And when you spin up a new server or repo, we nudge you to bring your agent back and put it under the same posture.
Audit your whole fleet — public and private repos, up to 10 servers.
Expert help getting set up, plus a human in the loop as you scale.
For organizations with no in-house security or DevOps team to skill up. We stand up your repos, servers, automations, and posture for you — and stay on as an ongoing engagement to keep hardening your security as your fleet grows.
OurCVEs is shipped by the small team at Artisan Build — a Delaware-based studio that has been writing Laravel for years before AI got cool. The agent does the grunt work; the people below decide what ships, answer your support emails, and own the calls that matter when an incident lands at 2am.
Volume of CVEs published per week. Toggle ecosystems and time scale to explore peaks and trends.
Range
Scale
Ecosystems
OurCVEs ships with an agentic onboarding workflow. Paste the prompt into Claude, Cursor, or any MCP-capable agent — it will read our setup guide at /llms.txt, send you a one-click magic link, and wire itself up to your team. After that you can ask "what are my current vulnerabilities?" right where you already work.
One browser visit (the magic link). Everything else stays in the agent.
Read https://ourcves.com/llms.txt and onboard me to OurCVEs. Ask me for my name and email, then walk me through the magic-link confirmation and wire up the OurCVEs MCP server in this client.Works with Claude Code, Cursor, Claude Desktop, and any agent that speaks MCP