CVEngine

CVEngine is an AI-first external attack-surface assessment project (GPL-3.0). It discovers assets, matches live CVE feeds, uses AI for triage, and validates in a read-only way; it also exposes MCP / REST for agents. Repo created 2026-10-24, ~240★; launch buzz ~681♥ / 103RT.

Stack: Django 5.2 + PostgreSQL 18, with Docker Compose self-hosting as the documented path.

Feature overview

1. Asset discovery — wires bbot / nmap / naabu / nuclei and similar recon / scan tooling
2. CVE matching — live feeds such as cve.now and CISA KEV, organized with fire / smoke / ice style severity or status labels (see repo docs)
3. AI triage + read-only validation — models help prioritize and explain; validation stays read-only to reduce production risk
4. Agent interfaces — MCP and REST so security assistants or pipelines can consume findings

Deployment

Aimed at self-hosted security teams: Compose brings up Django + PostgreSQL on an internal or isolated network. License is GPL-3.0 — watch compliance for redistribution and closed-source embedding.

This page summarizes public features and repo facts only; it does not provide attack steps or exploit details. Use attack-surface assessment only on systems you are authorized to test.

Get it and self-host

• Repo: https://github.com/hevnsnt/CVEngine (GPL-3.0)
• Typical path: follow the README and start with Docker Compose (Django 5.2 + PostgreSQL 18)
• After MCP / REST endpoints are up, wire findings into a security agent or ticketing flow

Who it's for

• Security engineering teams tracking external attack surface against KEV / live CVE feeds
• People connecting asset discovery + CVE triage into MCP agent pipelines

Notes

• Use only within authorized scope; GPL-3.0 constrains derivatives and distribution
• Scan / validation toolchains can trip IDS / WAF — rehearse in an isolated environment first