Cve.now: A Free Vulnerability Intelligence Feed for Agents

Why Agents Need a Dedicated Vulnerability Intelligence Source

When AI Agents begin autonomously calling APIs, reading files, and executing code, the attack surface they face is completely different from that of traditional human users. The core positioning of Cve.now, as raised on Hacker News, is to provide a structured security vulnerability Feed for non-human consumers like Agents. According to the introduction on HN, this is a free, directly program-consumable vulnerability data source. Its goal is not to give security analysts a pretty dashboard, but to let Agents query in real time during operation: "Does this library I just called have any known issues?"

This shift in thinking is worth noting: for the past two decades, the CVE ecosystem has served humans—security teams, operations, and penetration testers. But an Agent's decision chain operates at millisecond granularity; it won't open a browser and browse NVD pages. It needs an interface that can be directly parsed, with clear fields, and no login required. Cve.now returns the word "Feed" to its most original meaning: a machine-readable data stream.

The Relationship Between CVE and NVD: CVE (Common Vulnerabilities and Exposures) is a vulnerability numbering system maintained by MITRE. It assigns a unique identifier (such as CVE-2024-12345) to each publicly disclosed security vulnerability, but does not itself contain technical details. NVD (National Vulnerability Database) is an enriched database built by NIST based on CVE numbers, supplementing structured fields such as CVSS severity scores, CPE (Common Platform Enumeration) matching, and affected version ranges. If an Agent directly consumes raw CVE entries, it often gets only a number and a brief description. To determine whether a dependency is actually affected, NVD's enriched data or vendor advisories are usually needed. Understanding this layering helps design an Agent's query chain: first obtain the CVE number, then correlate with NVD or vendor data, and finally match against local dependency versions.

Free and Open: Lowering the Barrier to Agent Security Capabilities

The HN post has limited information, giving only the key attribute "Free Feed," but this has considerable engineering significance. Commercial vulnerability intelligence (such as databases from various SCA vendors) usually charges by seat or API call volume, while in Agent scenarios the call frequency may be extremely high—an automated code generation pipeline would need to query once for every dependency list it produces. A free Feed eliminates this cost friction, allowing individual developers and small teams to attach basic vulnerability checking capabilities to their self-built Agents.

However, free also means you must bear the judgment of data freshness and completeness yourself. There are time gaps between CVE number assignment, NVD enrichment (CVSS scoring, CPE matching), and vendor advisories. If an Agent directly consumes raw CVE entries, it may well get data that has not yet been analyzed and lacks impact range descriptions. This requires designing fallback strategies during actual integration, such as treating entries without scores as high risk by default, or cross-confirming with multiple sources.

Limitations of CVSS Scoring: CVSS (Common Vulnerability Scoring System) provides a severity score from 0 to 10 and is one of the most commonly machine-read fields in vulnerability intelligence. But the CVSS base score reflects the general severity of the vulnerability itself and does not consider the specific environment—the actual risk of the same vulnerability under different deployment methods and different network exposure surfaces can vary enormously. If an Agent relies solely on CVSS thresholds for decisions (such as "block if the score is greater than 7"), it is prone to a large number of false positives or false negatives. A more reasonable approach is to use CVSS as an initial screening signal, then make a second judgment based on context such as version ranges, runtime environment, and dependency call paths. This is also one of the technical roots of the article's emphasis that "machine-readable does not equal machine-usable."

Three Lessons for Agent Security Engineering

First, intelligence consumption must be built into the toolchain. Encapsulate a Feed like Cve.now as an Agent tool function, so the model proactively queries before introducing new dependencies or generating installation commands. This fits the Agent's workflow better than post-hoc scanning.

Second, the Feed itself needs trust verification. This post on HN has only 3 points and 0 comments, and the community has not yet formed discussion about its data sources, update frequency, or maintainer background. Before integrating it into a production environment, you should confirm whether its data comes from official CVE/NVD channels, whether it has a stable SLA, and whether it provides a changelog.

Third, machine-readable ≠ machine-usable. Structured fields are only a starting point. Agents also need semantic-level judgment—whether a vulnerability affects the version range currently in use, and whether it is exploitable in the current runtime environment. This layer of logic currently still needs to be added by developers themselves, or completed by the Agent through contextual reasoning, and the latter precisely requires high-quality, low-noise input data.

Division of Labor Between SCA and Vulnerability Feeds: The core capability of SCA (Software Composition Analysis) tools is to parse a project's dependency tree, identify the components actually introduced and their versions, and then compare them against vulnerability databases. A Feed like Cve.now provides "vulnerability knowledge," while SCA solves "whether your project actually contains this component, and which version." The two are complementary: a Feed can serve as one data source for SCA, but if an Agent only has the Feed without a dependency list and version parsing capability, it still cannot determine whether it is affected. In engineering terms, when encapsulating Feed queries as tool functions, the Agent should also be able to obtain a snapshot of the current environment's dependencies; otherwise the query results lack operability.

How to View This Project at This Stage

Cve.now currently looks more like a directional proposal than a mature product: its low discussion volume on HN indicates that it has just entered public view and lacks community scrutiny. But the entry point of "a vulnerability Feed designed for Agents" captures a real pain point—AI coding assistants and automated Agents are introducing large numbers of third-party dependencies, while the security review step is often skipped. If this kind of free Feed can operate stably and gradually fill in fields such as version ranges and exploitation conditions, it has the potential to become one of the infrastructure components in the Agent tool ecosystem. In the short term, it is advisable to use it as an auxiliary data source alongside mature SCA tools, rather than as the sole basis.