For agents
Put Global Hack Map inside your agent
Read the situation, check your stack and turn a CVE into a pull request. Connect over MCP, or give your coding agent a fix runbook.
- No Global Hack Map API key
- Six read-only tools
- No paid research calls
Connect over MCP
Claude Code
Run this command in your terminal.
claude mcp add --transport http globalhackmap https://globalhackmap.vercel.app/api/mcpClaude.ai and Claude Desktop
Add a remote MCP server in your client’s settings and paste this URL. Look for Connectors or Add custom connector; the labels depend on your client version.
https://globalhackmap.vercel.app/api/mcpChatGPT
In Settings, look for Apps or Connectors. If developer mode and custom MCP connectors are available for your account, add a remote MCP server and paste this URL.
https://globalhackmap.vercel.app/api/mcpCursor
Add this server to your project’s MCP configuration, preserving any existing entries.
{"mcpServers": {"globalhackmap": {"url": "https://globalhackmap.vercel.app/api/mcp"}}}VS Code
Add an HTTP server to your project’s MCP configuration.
{"servers": {"globalhackmap": {"type": "http","url": "https://globalhackmap.vercel.app/api/mcp"}}}Codex
Add this entry to your Codex configuration.
[mcp_servers.globalhackmap]url = "https://globalhackmap.vercel.app/api/mcp"Using another client? Add a remote Streamable HTTP MCP server with the Global Hack Map URL. No API key is needed.
Tools
Six tools, one sourced picture
Results preserve confirmed, reported and claimed statuses. Cite the source links and the status together. A claim is an attacker’s assertion.
Tool
What you get
- get_situation()
- The cached picture: important incidents, trending and exploited CVEs, malicious packages and active outages.
- patch_now()
- What attackers are exploiting today, per product: what they can do, who is affected and the fix.
- search_incidents(query?, country?, status?, since_days?, limit?)
- Find incidents by name, actor or domain, with country, status and date filters.
- get_incident(id)
- A full incident record, its sources, status and practical guidance.
- get_cve(cve)
- Merged CVE facts, a runbook URL and the exact prompt for a repository fix.
- check_stack(input)
- Check a manifest, lockfile or product list against public vulnerability data.
For stack checks, remove credentials, private registry URLs and other sensitive information before sharing input. No result is a guarantee that your stack is safe.
Limits and troubleshooting
Use Streamable HTTP at the exact server URL above. Stack checks accept up to 500 KB and check at most 1,000 packages; read the coverage notes in each result.
Requests are limited per IP. On HTTP 429, wait for the Retry-After interval before retrying. HTTP 503 means a service or request protection is temporarily unavailable.
Confirmed, reported, claimed, precautionary and disputed are distinct statuses. An empty result means no matching record in the available data, not proof of safety.
Runbooks
Fix a CVE from your coding agent
Point your coding agent at /fix/<CVE-ID>. Each runbook:
- 01Checks whether the repository is affected
- 02Lists the available version evidence
- 03Guides a minimal fix
- 04Asks for tests before a pull request
Trending now
CVE-2026-111497pip brotli
Check whether this repository is affected by CVE-2026-111497 and fix it if it is.
Fetch https://globalhackmap.vercel.app/fix/CVE-2026-111497 (use curl if you have no fetch tool) and follow the runbook. Find every place the affected package or product is used, upgrade to a fixed version, run the tests, and open a pull request that explains the change. If the repository is not affected, say so and explain why. Ask me before running anything that costs money.The agent opens with this prompt and nothing runs until you send it. It must verify the vendor advisory, preserve your work and stop if the evidence is insufficient. Runbooks never authorise exploit code, paid actions, deployment or merging.
JSON API
Read the snapshot
The same cached picture, as JSON. Check its generation time and feed availability alongside the records.
curl -fsSL 'https://globalhackmap.vercel.app/api/snapshot'Go deeper
Research with Valyu
Global Hack Map is built on Valyu’s search and DeepResearch APIs. For cited research beyond the snapshot, agents can use Valyu’s own MCP server or the valyu CLI. Ask before research that costs money.
https://mcp.valyu.ai/mcp