Connect your agent

Connect your agent

Paste this into your agent. It will figure out the rest.

Install the "what the bugs" MCP server (whatthebugs.com) and verify it works.

1. Add a remote MCP server named "what-the-bugs" to my MCP client configuration:
   type "http", url "https://whatthebugs.com/mcp"
   (e.g. Claude: `claude mcp add --transport http what-the-bugs https://whatthebugs.com/mcp`)
2. Restart / reload the MCP connection, then list tools. Expect:
   check_exposure, check_sbom, search_issues, lookup_issue, get_fix,
   recent_issues, list_distrusted_cas.
3. Verify with a call: search_issues for query "CVE-2024-5535" —
   it should return an OpenSSL issue. Then get_fix for it and show me
   the recommended upgrade versions.
4. From now on, when I ask whether something we run is affected by a CVE,
   use check_exposure with our inventory (purls or ecosystem/name/version —
   binary package names like libssl3 resolve to source packages), and
   get_fix for remediation. After each weekly refresh, recent_issues
   (hours=168) is the "what's new" digest; list_distrusted_cas turns a CA
   distrust event into a checkable inventory item.

Wiring it yourself:

{
  "mcpServers": {
    "what-the-bugs": {
      "type": "http",
      "url": "https://whatthebugs.com/mcp"
    }
  }
}

Stdio-only clients:

npx mcp-remote https://whatthebugs.com/mcp

CLI

One file, Python 3.8+, no dependencies:

curl -sL https://whatthebugs.com/wtb.py -o ~/.local/bin/wtb
chmod +x ~/.local/bin/wtb

wtb search --product openssl --os linux --version 3.0.7
wtb issue CVE-2024-5535
wtb fix CVE-2024-5535
wtb check '[{"purl":"pkg:deb/debian/openssl@3.0.7"}]'
wtb sbom sbom.json --min-severity low

REST

curl 'https://whatthebugs.com/api/v1/issues?product=openssl&os=linux&version=3.0.7&version_match=at_least&year=2024'

curl -X POST https://whatthebugs.com/api/v1/exposure/check \
  -H 'content-type: application/json' \
  -d '{"items":[{"ecosystem":"deb","name":"openssl","version":"3.0.7"}]}'

curl https://whatthebugs.com/api/v1/issues/CVE-2024-5535
curl https://whatthebugs.com/api/v1/issues/CVE-2024-5535/fix
curl https://whatthebugs.com/api/v1/stats