About vulntel
vulntel is built and run by one person, rozetyp. It is free, built for fun, and given away in exchange for feedback. There is no paid tier.
What that means for you
- It is free. Nine of its 13 tools work without a key (25 calls a day per IP address). A free key, sent to your email, unlocks all 13 at 60 calls a minute: get a key.
- It is one person's project. There is no support contract or uptime promise. The data refreshes daily, and
corpus_statstells you exactly how fresh it is before you rely on an answer. - What it keeps is written down. What vulntel keeps about your work is written from the code, with retention periods and how to delete your data.
- What is open. The bug-bounty skill and MCP playbook are MIT-licensed. The hosted server itself is not open source.
What we ask in return
Tell us what is wrong. A wrong answer, a CVE it missed, a tool your agent misused, a page that says something untrue: open an issue at github.com/rozetyp/vulntel-mcp/issues, or email [email protected]. Please do not post secrets, private findings or a program's confidential details in a public issue.
How it compares
It will not out-cover the big vendors, and the comparison pages say where each of them is stronger. What it aims to be is a free, source-grounded intelligence layer for an agent: CVE facts fused from public sources, mechanics from disclosed reports, and a fact-check for the claims an agent makes.
For authorized security research and bug-bounty work only, on targets you are permitted to test.