the magpie hoards what matters

Vulnerability intelligence for any package.

Paste a package coordinate and magpie pulls its metadata and known vulnerabilities from ecosyste.ms, OSV and NVD, resolves its CPE via VulnCheck, and gives you one consolidated view per purl — no account.

What it is

A single Go binary serves a dashboard and JSON API. Hand it a package coordinate — pkg:npm/axios@1.6.0 — and it gathers everything known about that package across three sources, cross-references them to resolve the package's CPE, and caches the result in SQLite. Repeat lookups are instant.

Named after the bird that hoards shiny things: magpie collects every scrap of security signal about a package into one hoard, so you don't have to stitch three databases together by hand.

What it pulls from

How it works

1. Metadata. ecosyste.ms returns the package's repository, licenses and inline advisories.
2. Vulnerabilities. OSV is queried per purl and grouped by canonical CVE.
3. CPE resolution. magpie cross-checks the CVEs against NVD's CPE configurations — fetched by CVE through VulnCheck's NVD2 index — matching on name, vendor, ecosystem and version range to pin the package's cpe:2.3 identifier.
4. NVD records. With the CPE resolved, it pulls NVD's vuln records for it and joins them into the bundle.
5. Cache & refresh. Everything lands in SQLite with per-source freshness windows; a background updater quietly refreshes stale packages.

magpie is alpha and built for research. It's useful today, but the scope is narrow and the data model still moves. It runs single-tenant and unauthenticated for now — a single binary over an embedded SQLite store.

Try it