the patch stream for agents
Found at machine speed.
Patched at machine speed.
AI is surfacing critical issues faster than any team can triage. what the bugs is the one stream of everything that needs patching — CVEs, distro advisories, CA distrust, EOL cycles — normalized with exact version ranges and fix pointers. Your agents read it over MCP and patch at the speed discovery happens.
One stream
KEV, NVD, OSV (Debian, Rocky, AlmaLinux, Maven, PyPI, npm, Go…), OneCRL distrust, endoflife.date — deduped across registries, ranked, high-and-above by default.
Exact ranges
Not "affected, probably" — introduced/fixed version intervals per ecosystem. Exposure checks answer yes or no, with the fix pointer.
Agents close the loop
check_exposure, search_issues, get_fix over MCP. A CVE published at 12:17 is checkable against your systems by 12:18.
One config block and your agent is patched-aware.
Works with any MCP client — Claude, Codex, or your own. Streamable HTTP, no keys, no setup beyond the URL.
{
"mcpServers": {
"what-the-bugs": {
"type": "http",
"url": "https://whatthebugs.com/mcp"
}
}
}Discovery is automated. Patching isn't yet.
That gap is where you get breached.