# VulnGraph

> Evidence-backed view of open-source vulnerabilities across a fleet of services, with a ranked remediation plan. HTTP API at https://api.vulngraph.igentify.in/v1 and MCP server at https://api.vulngraph.igentify.in/v1/mcp (Authorization: Bearer <API key>).

Start with the portfolio endpoints or portfolio_* MCP tools (small answers; quote data_as_of; portfolio_image for base images and image chains, portfolio_path for how a package reaches a service). Whole site in one file: https://docs.vulngraph.igentify.in/llms-full.txt

## Docs

- [Overview](https://docs.vulngraph.igentify.in/): What VulnGraph is and where to start
- [Concepts](https://docs.vulngraph.igentify.in/concepts): MStF, plan, steps, Decide, waves, sketch, start here
- [Using the app](https://docs.vulngraph.igentify.in/using-the-app): Overview, runs, Brief, Plan, Graph, Explanations, Logs, keys
- [API keys](https://docs.vulngraph.igentify.in/api-keys): Creating keys, scopes, expiry, activity
- [API reference](https://docs.vulngraph.igentify.in/api-reference): Every /v1 endpoint: scope, parameters, response, errors
- [MCP](https://docs.vulngraph.igentify.in/mcp): MCP endpoint, auth, the 27 tools, Cursor config
- [Agent skills](https://docs.vulngraph.igentify.in/agent-skills): Install VulnGraph skills for Cursor, Claude Code and other agents
- [Errors and limits](https://docs.vulngraph.igentify.in/errors-and-limits): Error codes, rate limits, size limits
- [Glossary](https://docs.vulngraph.igentify.in/glossary): Short definitions

## Agent skills

Install all: npx skills add https://docs.vulngraph.igentify.in (or download https://docs.vulngraph.igentify.in/agent-skills/vulngraph-agent-skills.tar.gz)

- [vulngraph-ask](https://docs.vulngraph.igentify.in/.well-known/skills/vulngraph-ask/SKILL.md): Answer questions about vulnerabilities across a portfolio of services with VulnGraph: how bad it is, what to fix first, how exposed a service is, whether a CVE affects us, where a package is used, which base image a service is built on, how a package reaches a service, what changed and the trend. Use when: (1) someone asks about CVEs, advisories, vulnerable packages or exposure, (2) a manager wants a status or trend, (3) an engineer asks what to fix first or what is blocked, (4) a service, package or CVE name may be misspelled.
- [vulngraph-connect](https://docs.vulngraph.igentify.in/.well-known/skills/vulngraph-connect/SKILL.md): Connect an AI agent to VulnGraph: get an API key with the right scopes, add the VulnGraph MCP server to Cursor or Claude Code without putting the key in a config file, fall back to plain HTTP, and verify the connection. Use when: (1) setting up VulnGraph for an agent for the first time, (2) choosing scopes for a key, (3) writing an MCP config for VulnGraph, (4) checking that an agent can reach VulnGraph.
- [vulngraph-debug](https://docs.vulngraph.igentify.in/.well-known/skills/vulngraph-debug/SKILL.md): Diagnose problems talking to VulnGraph by symptom: 401 and 403 errors, not-found answers with did_you_mean, 429 rate limits, stale or truncated answers, and MCP connection failures in Cursor, Claude Code or the mcp-remote bridge. Use when: (1) a VulnGraph call fails or returns an error, (2) the MCP server does not show up or shows no tools, (3) answers look old, cut short or wrong, (4) a scan run failed.
- [vulngraph-decide](https://docs.vulngraph.igentify.in/.well-known/skills/vulngraph-decide/SKILL.md): Resolve VulnGraph Decide steps: read the numbered options for a vulnerable package with no fixed version, choose one with a short recorded reason, say what the decision unblocks, and escalate to a person when the choice is not the agent's to make. Use when: (1) a plan has Decide steps or decide_count is above zero, (2) remediation is blocked on a decision, (3) asked to replace, patch, mitigate or accept the risk of a vulnerable dependency.
- [vulngraph-remediate](https://docs.vulngraph.igentify.in/.well-known/skills/vulngraph-remediate/SKILL.md): Work through a VulnGraph remediation plan like a developer would: in waves, at most one pull request per repository, Decide steps treated as blockers, and every step's real status recorded. Use when: (1) asked to fix vulnerabilities from a VulnGraph plan, (2) picking the next step or wave to work on, (3) opening, tracking or closing PRs for plan steps, (4) choosing the minimal severity to fix (MStF).