Get threats where you work

Everything on the radar is available as RSS, JSON and a remote MCP server, so your feed reader, your CI or your coding agent hears about a new critical bug minutes after it is disclosed. No account, no key.

MCP server (Claude Code, Cursor, any MCP client)

Tools: latest_threats, get_threat, check_packages.

claude mcp add --transport http zeroradar https://zeroradar.vercel.app/api/mcp

Then just ask: “anything new on Zero Radar that affects this repo?”

Claude Code skill

Scans lockfiles (npm, pnpm, yarn, bun, composer, pip/poetry/uv, cargo, go, bundler), checks them against the radar and fixes what is affected.

git clone --depth 1 https://github.com/legifx/zeroradar /tmp/zeroradar
cp -r /tmp/zeroradar/skill/zeroradar ~/.claude/skills/

Or run the scanner directly, e.g. in CI (exit code 2 = findings):

node ~/.claude/skills/zeroradar/scripts/scan.mjs .
node ~/.claude/skills/zeroradar/scripts/scan.mjs --latest   # new top threats since last run

RSS

https://zeroradar.vercel.app/feed.xml                      # top threats
https://zeroradar.vercel.app/feed.xml?view=exploited       # exploited in the wild
https://zeroradar.vercel.app/feed.xml?view=fixes           # a fix was released (one item per fix)
https://zeroradar.vercel.app/feed.xml?view=unpatched       # important, still no fix
https://zeroradar.vercel.app/feed.xml?view=breaches        # data breaches & incidents
https://zeroradar.vercel.app/feed.xml?view=all&eco=npm     # every npm vulnerability

JSON API

GET  https://zeroradar.vercel.app/api/advisories?view=top&since=2026-10-25T00:00:00Z&eco=pip&q=django&limit=50
POST https://zeroradar.vercel.app/api/check
     {"packages":[{"ecosystem":"npm","name":"next","version":"16.2.9"}]}

view: top · exploited · unpatched · fixes · breaches · all · malware · everything. Each entry carries exploited, fix (with since) and confidence. Only names and versions are sent to /api/check; nothing is stored.

How fast is it?

The pipeline runs continuously and checks each source on its own schedule, the fastest every minute. When something changes, the site is told right away and serves the new data within seconds. Every entry shows when it was disclosed and when Zero Radar picked it up. Zero Radar only reports issues that are already public. Details: How it works.