No false end-of-life alarms
A distribution package that its vendor still patches, such as nginx on a supported Ubuntu, is not flagged as end of life.
Open source · Self-host or cloud · Your data stays yours
Know every piece of software you run. Fix what matters first.
One live inventory of your servers, deployed applications, repositories, containers, Kubernetes and cloud services. Stackurity matches it against new vulnerability advisories every hour, and against CISA’s exploited list and end-of-life dates every day, then tells each team exactly what to upgrade and checks again to prove it is fixed.
Stackurity Cloud: 14 days free, no card needed, then from $10 a month₹799 a month, GST additional. Self-hosted Community is free forever. See pricing
- 10Linux distributions
- 9language ecosystems
- Hourlynew advisories matched
- CVSS v3 + v4scored locally
- Apache-2.0open-source core
How it works
From “what do we even run?” to a short list of upgrades
1
Connect
Install the read-only agent with one command, add repositories from Git or CI, connect Kubernetes and AWS, or import an SBOM. A server shows its first results about 2 minutes after the install command.
2
Inventory
Packages, runtimes installed by hand, the libraries deployed apps actually load, images and the workloads running them, all in one inventory.
3
Prioritise
Matched against OSV, vendor advisories, CISA’s exploited list and end-of-life data with each ecosystem’s own version rules, then ranked P1 to P4 by exploitation, exposure and environment.
4
Fix and prove
Each fix is one upgrade that clears many issues. Apply it, press Check again, and fresh evidence decides: passed, partly fixed or still open.
Product
Everything a small team needs to stay patched
Click any screen to see it full size. Screens show the demo estate that ships with Stackurity.
A first result in about 2 minutes
A new organisation names a project and adds something to check: one command installs the read-only agent on a server and finds the websites and apps on it, or connect a repository, a cluster or an SBOM. The result arrives in plain words.
- Linux servers, repositories, images, Kubernetes, AWS and SBOMs; end-of-life checks and missing cumulative updates (KB) for Windows Server and Windows
- Connecting a server with a backlog sends one message, not hundreds
- Invite people by email with a role on the project
Fix what matters first
Home opens on the few fixes that need you now, not a wall of CVEs. Each fix is one change, the version to move to and why, and every issue it clears.
- P1 to P4 from exploitation, exposure and environment
- Says how many issues it is not showing, and why
- Upgrades lead with the recommended version and warn about major jumps and withdrawn versions
See what runs, not just what is declared
Each application appears with its host, operating system, web server, runtime and libraries, linked to the repository it was built from and the images it runs as.
- End-of-life runtimes and operating systems flagged before they bite
- Kubernetes workloads, their images and whether they are reachable from outside
- Search a CVE, package, host or image digest and land on everything affected
Trust every finding
Every finding says in one sentence why it applies: the installed version and where it was seen, the advisory’s affected range, the rule that matched and when the source last refreshed.
- Urgent findings get an independent second check
- Anything that could not be checked is listed as a gap, never shown as healthy
- Distro backports are not false alarms
Fixed means checked
“I applied this” never closes an issue on its own. Check again asks the agent for a fresh report within a minute, and the result is recorded with who asked and when.
- Passed, partly fixed or still open, with the steps to finish
- Issues that come back are flagged as regressed and alerted on
- Automatic fixing with canary rollout and rollback Pro
Built for teams and clients
Group assets into projects, such as a site, a client or a product, and give a team or a client a role on just theirs. Access is enforced by the database itself.
- Alerts to Slack, Microsoft Teams, email, webhooks or Jira, set up in Settings → Integrations; tick what each sends: urgent issues, all new ones, issues that came back, or a daily or weekly summary
- Assign, snooze and ignore with a reason and an expiry, with an approval inbox
- Several teams, routing and escalation of overdue issues Pro
Evidence for audits Pro
Answer security questionnaires and audits with a patch-management report for any period: what was collected, what was open and overdue, what was fixed and how fast, and every accepted risk with its reason.
- Share resolved within deadline and median days to fix, counting only real fixes: issues closed because an advisory was withdrawn are listed apart
- Every exception with its reason, mitigation and expiry
- Drift between production and its standby or staging copies
And more
The details that make it work day to day
CI gate
stackurity scan --fail-on stops a vulnerable change before it ships.
Kubernetes
Read-only, least-privilege access to workloads, images, exposure and cluster versions.
AWS managed services
RDS, Aurora, ElastiCache, EKS, Lambda and OpenSearch versions checked for end of life.
Stack packs
Java (including deployed JARs and WARs), Rust, Elixir, Swift and C/C++ as signed packs that run in a sandbox.
Reboot and drift
Hosts running older code than is installed, and standbys that drifted from production.
Phone friendly
Check what needs you from your phone, with Assign, Snooze and Open in Slack.
Workspaces
Separate organisations on one installation, isolated by row-level security.
AI assistants
Ask your assistant what to patch
Connect Claude, ChatGPT, Cursor, VS Code or any assistant that supports MCP with one URL and a sign-in, nothing to install. Settings → AI assistants has the steps for each. It sees what you see, read-only unless you tick Allow changes; then it can assign, snooze and check fixes again, showing you a preview before each change. Ask in plain words:
- What should we upgrade first on the shop servers?
- Why is CVE-2025-29927 a P1 for us?
- Which version of Next.js clears all of these?
- Did last night’s upgrade fix it?
Add a custom connector
https://app.stackurity.dev/mcp
In Claude: Settings → Connectors → Add custom connector, paste the URL, then Connect and sign in. Choose the organisation or one project, and a role. Self-hosted: use https://<your server>/mcp.
Claude Code
claude mcp add --transport http stackurity \ https://app.stackurity.dev/mcp
Then run /mcp in Claude Code to sign in.
MCP clients that start a local process
{
"mcpServers": {
"stackurity": {
"command": "stackurity",
"args": ["mcp"],
"env": {
"STACKURITY_SERVER": "https://stackurity.example.com",
"STACKURITY_TOKEN_FILE": "/home/me/.config/stackurity/token"
}
}
}
}
Disconnect any assistant at once from Settings → AI assistants. All tools and how sign-in works
Integrations
Works with what you already use
- Slack Add to Slack, alerts and actions
- Microsoft Teams
- Webhooks
- Jira issues per incident or project
- Git repositories
- CI scan and gate
- Kubernetes
- AWS
- Container images
- CycloneDX and SPDX SBOMs
- VEX OpenVEX and CycloneDX, in and out
- MCP Claude, ChatGPT, Cursor, VS Code
- REST API
- Prometheus metrics
Editions
Free to find problems. Pay for automation and hosting.
Community
Free forever, self-hosted
- All discovery, vulnerability and end-of-life checks
- Priorities, fixes, upgrade recommendations and Check again
- Projects, access, alerts, Jira, CI gate and MCP
Stackurity Cloud
From $10 a month₹799 a month, GST additional, 14-day free trial
- We run it for you, with daily backups
- Starter, Team and Business plans by projects and assets
- Pro features on Team and Business
Enterprise
Self-hosted or hosted
- Everything in Pro, including single sign-on
- Enterprise stack packs, built on request, and help with high availability
- Volume pricing and priority support
Your inventory stays yours
Self-hosted Stackurity runs on your own server. Agents only connect out and only read unless you turn on automatic fixing. There is no telemetry. Besides the advisory feeds and the integrations you set up, the only automatic outbound request is an anonymous check for new releases on GitHub, which sends nothing about you and can be turned off. Every outbound connection is documented.
Open source
The core is Apache-2.0: read the code, run it anywhere, change it. Pro and Enterprise are a licence key away on the same installation, and licences are verified offline.
See your own estate in about 2 minutes
Start a free trial of Stackurity Cloud, download the free Community edition, or tell us about your estate and we will show you Stackurity on it.
Talk to us
Want a demo, Pro or Enterprise, or a pilot on your estate? Tell us a little about it and we will reply by email.
We use what you send only to reply to you. See the Privacy Policy.