CLI — one file, no dependencies

Python 3.8+ stdlib only. Install:

curl -sL https://whatthebugs.com/wtb.py -o ~/.local/bin/wtb
chmod +x ~/.local/bin/wtb
wtb stats

Search with the same filters the dashboard has:

wtb search --product openssl --os linux --version 3.0.7 --version-match at_least
wtb search "pam_unix"
wtb issue CVE-2024-5535
wtb fix CVE-2024-5535

Check an inventory or a CycloneDX/SPDX SBOM (e.g. from syft) for exposure — high+ by default:

wtb check '[{"purl":"pkg:deb/debian/openssl@3.0.7"},
              {"ecosystem":"npm","name":"lodash","version":"4.17.20"}]'

syft . -o cyclonedx-json > sbom.json
wtb sbom sbom.json --min-severity low

Point it elsewhere with WT_API; add WT_API_KEY when an authenticated tier exists.

MCP — point your agent at it

The index is served as MCP over HTTP at https://whatthebugs.com/mcp. Tools: check_exposure, search_issues, lookup_issue, get_fix. Client configuration (Claude / any client that speaks streamable HTTP):

{
  "mcpServers": {
    "what-the-bug": {
      "type": "http",
      "url": "https://whatthebugs.com/mcp"
    }
  }
}

Clients that only speak stdio can bridge with npx mcp-remote https://whatthebugs.com/mcp.

Raw JSON-RPC works too:

curl -s https://whatthebugs.com/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

REST

Base URL: https://whatthebugs.com/api

# search: product + os + version + date filters
curl 'https://whatthebugs.com/api/v1/issues?product=openssl&os=linux&version=3.0.7&version_match=at_least&year=2024'

# lookup any issue by any alias
curl https://whatthebugs.com/api/v1/issues/CVE-2024-5535

# fix pointers
curl https://whatthebugs.com/api/v1/issues/CVE-2024-5535/fix

# exposure check
curl -X POST https://whatthebugs.com/api/v1/exposure/check \
  -H 'content-type: application/json' \
  -d '{"items":[{"ecosystem":"deb","name":"openssl","version":"3.0.7"}]}'

# index stats
curl https://whatthebugs.com/api/v1/stats

The hosted API is read-only — feed management and issue authoring run on the operator side.