Vulnerability Intelligence APIs Compared (2026)
This page is for engineers and AI-agent builders choosing a vulnerability intelligence API in 2026. Short verdict: pick VulnCheck if you need first-party exploit and exploitation telemetry and have the budget, Vulners if you want the widest source breadth on a mature self-serve plan, OpenCVE if you want free, self-hostable CVE alerting, and vulntel if you are driving an AI agent and want exploitation-first fusion plus a CVE fact-check over MCP.
Every cell is our reading of public docs and our own competitor research as of the date below. Vendor features move; if a cell is wrong, tell us and we will fix it. That honesty is the point: a comparison you can only trust when it flatters us is worthless.
The comparison table
Legend: yes = documented feature · no = not offered · partial = limited or tier-gated · ? = we could not verify, check the vendor.
| vulntel | VulnCheck | Vulners | OpenCVE | |
|---|---|---|---|---|
| NVD + CVSS | yes | yes | yes | yes |
| CISA KEV | yes | yes (VulnCheck KEV) | yes | ? |
| FIRST EPSS | yes | yes | yes | ? |
| OSV / GHSA | yes | ? | yes | ? |
| CISA SSVC | yes | ? | ? | no |
| Live PoC / exploit signal | yes | yes (first-party) | yes | no |
| MCP-native (for AI agents) | yes (12 tools) | yes (18 tools) | yes (7 tools, gated) | no |
| CVE-claim fact-check for agents | yes (verify_cve_claim) | no | no | no |
| Source breadth | ~8 fused feeds | 500M+ exploitation records | 220+ sources / 4M bulletins | NVD / MITRE based |
| Free tier | yes (auth. research) | partial (Community KEV free) | yes ($0 tier; MCP gated) | yes (open-source, self-host) |
| Pricing | free | enterprise / contact sales | $0 / $600 / $1,300 | EUR 19 / 49 / 299 (self-host free) |
Researched 2026-06 to 2026-08 from public documentation and our internal competitive analysis. ? means unverified, not "no".
When to use which (where each one is stronger)
- VulnCheck is the strongest here on exploit data. It runs a first-party exploitation corpus (500M+ records) with C2 and canary telemetry, and publishes VulnCheck KEV roughly 27 days ahead of CISA. If your decisions hinge on "is this being exploited right now, and did we know before NVD," that data moat is real and vulntel does not replicate it. It is priced enterprise.
- Vulners is the breadth and maturity leader for self-serve: 220+ sources and around 4 million bulletins, including indexed HackerOne reports and an SBOM analyzer, with a clean $0 / $600 / $1,300 ladder. Its MCP is gated at the $600 tier and is mostly commodity lookups. If you want one mature account that indexes almost everything, this is it.
- OpenCVE is the free, open-source choice. Self-host it and you get CVE search and subscription-based alerting on NVD/MITRE data at no cost. It is not MCP-native and does not carry exploit or PoC signal, but for a team that just wants to be notified when a subscribed product gets a new CVE, it is hard to beat on price.
- vulntel is built for the AI-agent use case specifically. It fuses NVD, KEV, EPSS, OSV/GHSA and SSVC into an exploitation-first ranking rather than raw CVSS, it exposes a CVE-claim fact-check so an agent's invented details get caught, and it can transfer attack mechanics across products. It does not have a sensor fleet or a first-party exploit corpus, so it is not the tool for real-time exploitation telemetry.
What to look for in a vulnerability intelligence API
If you are evaluating any of these, weigh four things over raw feed count:
- Fused sources, not one feed. A single lookup should already carry KEV, EPSS, and advisory data joined for you.
- Exploitation-first output (KEV / EPSS / SSVC), not just CVSS severity. Severity is not likelihood: see what actually predicts exploitation.
- A hallucination check if an AI agent consumes the output, so a confidently wrong CVE claim is refuted, not passed through.
- MCP-native access if you drive it from an agent, so it is a tool call rather than a scraping pipeline you maintain.
More on that last framing in what is a vulnerability intelligence API.
FAQ
Which vulnerability intelligence API is best for AI agents?
The one that is MCP-native and returns fused, exploitation-first data with a fact-check. vulntel and Vulners both ship an MCP; vulntel adds a per-claim CVE fact-check (verify_cve_claim) aimed at catching agent hallucinations. See the full write-up on the best vulnerability intelligence API.
Is there a free vulnerability intelligence API? Yes. OpenCVE is open-source and self-hostable for free, Vulners has a $0 tier, and vulntel is free for authorized security research. VulnCheck offers a free Community KEV feed, with the full platform priced enterprise.
Do these APIs include EPSS and KEV? vulntel, VulnCheck and Vulners all surface CISA KEV and FIRST EPSS. OpenCVE is built on NVD/MITRE data; verify its current KEV/EPSS support against its docs before relying on it.
Which has the best exploit data? VulnCheck, by a clear margin: a first-party exploitation corpus plus sensor telemetry. vulntel carries a public PoC signal (Metasploit, GitHub PoC) and predictive SSVC, not first-party exploitation telemetry.