# Active security threats

> A free, no-login live feed of security threats that are happening now: CISA KEV additions, CVEs with fast-rising EPSS scores, and malicious or hijacked packages and GitHub Actions from OSV (OpenSSF Malicious Packages, GitHub Advisory Database). Updated every 10 minutes.

## MCP server
- Endpoint: https://compromised.live/mcp (Streamable HTTP, no auth)
- list_feed(ecosystem?, kind?, min_tier?, since?, limit?): recent active threats
- get_threat(id): one threat by CVE, GHSA or MAL id
- check_dependencies(packages? | manifest? | actions?): which dependencies match active threats, with the nearest safe version

## JSON API
- GET https://compromised.live/api/v1/threats?ecosystem=npm,PyPI&kind=compromised_package&tier=2&since=7d&limit=50
- GET https://compromised.live/api/v1/threats/{id}
- POST https://compromised.live/api/v1/check  (JSON {packages, manifest, format, actions} or a raw lockfile body with ?filename=)

## Feeds (same query filters)
- https://compromised.live/feed.xml (RSS), https://compromised.live/feed.atom, https://compromised.live/feed.json

## Fields
- tier: 1 act now, 2 elevated, 3 bulk typosquat malware (hidden by default)
- kind: exploited_vuln, malicious_package, compromised_package, poisoned_action
- summary_source: "ai" summaries are generated from source text and can be wrong; "template" summaries are fixed wording