what the bug

Vulnerabilities are found at machine speed now.
Patching has to keep up.

AI is discovering critical issues faster than any team can triage them. Humans can't read 60,000 high-severity findings. Your agents can — if they have one place that already sorted what matters, what's exposed, and what fixes it.

what the bug is that place. One stream of everything that needs patching — CVEs, distro advisories, CA distrust events, end-of-life cycles, design flaws — normalized with exact affected ranges and fix pointers, served to your agent over MCP.

Connect your agent Browse the live index →
01

Every feed, one stream

CISA KEV, NVD, OSV (Debian, Rocky, AlmaLinux, Maven, PyPI, npm, Go, RubyGems…), Mozilla OneCRL distrust, endoflife.date, plus curated design flaws that never get a CVE. Merged across registries by alias, ranked by severity and exploitation, cut to high-and-above by default so nobody drowns.

02

Point your agent at it

It's an MCP server. check_exposure and check_sbom match your inventory against exact version ranges and return fix pointers, search_issues and get_fix answer questions, create_issue adds what only you know. One config block:

{
  "mcpServers": {
    "what-the-bug": {
      "command": "patch-mcp"
    }
  }
}
03

Agents close the loop

Inventory in, exposure out, upgrade decided — at discovery speed, not sprint speed. A critical CVE published at 12:17 is in the stream, ranked, and checkable against your systems before a human has opened the advisory. Patching at the speed it's found.

Discovery is automated. Patching isn't yet.
That gap is where you get breached.