# Stackurity > Stackurity is open-source vulnerability and end-of-life management. It keeps one live inventory of the software on your servers, deployed applications, repositories, container images, Kubernetes and AWS managed services, matches it against new vulnerability advisories and the CISA Known Exploited Vulnerabilities catalogue every hour and against end-of-life dates every day, and gives each team a short list of upgrades, most urgent first. After a fix it checks again and records whether the issue is really gone. Stackurity is sold by OUTDO INC (Bangalore, India). The core is Apache-2.0 on GitHub. It runs self-hosted (Community, free forever) or hosted as Stackurity Cloud at https://app.stackurity.dev. ## What it does - Inventory: a read-only agent on Linux servers reads installed packages, runtimes installed by hand and the libraries deployed applications actually load. In a deployed application it also finds front-end libraries that no package manager installed: versioned CDN addresses in templates (HTML, PHP and other template files; commented-out addresses are ignored) and the version banner of copied files, for 28 widely used libraries such as jQuery, Bootstrap and TinyMCE. Each is checked as the npm package it was published as. WordPress sites are found as applications from wp-config.php or wp-includes/version.php; the WordPress core version itself is not reported yet, and the copies WordPress core maintains are marked as needing validation. Packages are assessed on Debian, Ubuntu, Alpine, Rocky Linux, AlmaLinux, Red Hat Enterprise Linux, SUSE Linux Enterprise, openSUSE Leap, Oracle Linux and Amazon Linux 2023 and 2. Repositories (npm, Composer, PyPI, Go, RubyGems, NuGet, Dart, and Maven/Gradle, Cargo, Hex, Swift Package Manager, CocoaPods, Conan and vcpkg with stack packs; CocoaPods, Conan and vcpkg are inventoried only, as no public advisory database covers them), container images, Kubernetes workloads, AWS managed services (RDS, Aurora, ElastiCache, EKS, Lambda, OpenSearch) and CycloneDX or SPDX SBOMs can be added too. The agent also inventories Windows hosts, raises end-of-life findings for the Windows Server or Windows release they run, and reports missing monthly cumulative updates (with the KB to install) from Microsoft's Security Update Guide; installed programs are not matched against advisories. - Matching: OSV, vendor advisories, the CISA Known Exploited Vulnerabilities catalogue and end-of-life data, using each ecosystem's own version rules, so distribution backports are not reported as false alarms. CVSS v3 and v4 are scored locally. The CISA KEV catalogue is checked every hour and downloaded in full at least once a day; EPSS and end-of-life data are synced daily. When a feed stops syncing, every workspace gets an incident (after 12 hours for CISA KEV), and operators whose alert routes include feed problems are also told when it recovers. - Priorities: each finding is ranked P1 to P4 from exploitation, exposure and environment, and says in one sentence why it applies. A finding's EPSS is the highest among all the CVEs its advisories list, so an advisory covering several CVEs (such as a DSA, RHSA or SUSE-SU) counts its most likely exploited one, and the finding names that CVE. - Fixes: one card per upgrade, with the version to move to and every issue it clears. Check again asks the agent for a fresh report and records passed, partly fixed or still open. - Teams: projects, roles, alerts to Slack, Microsoft Teams, email, webhooks or Jira (each chooses what it sends: urgent issues, all new ones, regressions, daily or weekly summaries), assign, snooze and ignore with expiry and approval. PagerDuty and ServiceNow keep one alert or record per incident. PagerDuty is one-way: Stackurity triggers an alert, acknowledges it, pages again when the priority rises, the incident escalates or new findings arrive after an acknowledgement, and resolves it; nothing is read back from PagerDuty. In ServiceNow, Stackurity creates and updates one record per incident (in the incident table by default) with a configurable field mapping, and can read back only each record's state. - VEX: OpenVEX and CycloneDX VEX documents (also as signed in-toto attestations) are imported and shown on findings; a not_affected statement ignores the findings it covers only after a person approves it, or from a source an admin trusts. Decisions are exported as OpenVEX or CycloneDX VEX. CSAF VEX is not read. - Evidence: outcome and audit reports count only real fixes (upgraded or removed); issues closed because an advisory was withdrawn or changed are listed apart. - AI assistants: an MCP server at https://app.stackurity.dev/mcp (or https:///mcp when self-hosted) with OAuth sign-in, for Claude, ChatGPT, Cursor, VS Code and other MCP clients. Read-only unless the user ticks Allow changes; every change is previewed first. - CI gate: `stackurity scan --fail-on` stops a vulnerable change before it ships. - Not covered: network appliance firmware (for example firewalls and VPN gateways), statically linked libraries, libraries copied into an application outside a package manager or lockfile other than the 28 front-end libraries recognised by their version banner, and CentOS, Fedora and Oracle Linux 5 packages (inventoried and shown as gaps, not assessed). Oracle Linux is assessed from Oracle's own advisories (ELSA) for releases 7 to 10; Ksplice live kernel patches are not read, and module streams not named by a version can be compared across streams. Runtimes installed outside a package manager are checked for end of life only. .NET on Linux is checked for end of life from its distribution packages (dotnet-runtime-X.Y); .NET installed by script or tarball, and .NET on Windows, is not. On Windows, the operating system is checked for end of life and for missing cumulative updates; .NET Framework, Office and servicing stack updates, hotpatched hosts, installed programs and Store apps are not assessed, and Windows Server 2012 R2 and older get end-of-life findings only. ## Pricing - Community: free forever, self-hosted, all detection features. - Stackurity Cloud: 14-day free trial without a card. Starter $10 a month (1 project, 5 assets), Team $35 (3 projects, 20 assets), Business $79 (10 projects, 50 assets, then $1.50 (₹125) per extra asset). Yearly plans cost ten months. Prices in India are in rupees plus 18% GST. Starter has the Community features; Team and Business include Pro (automatic fixing, evidence reports, several teams, escalation). The trial has Team's features. - When a trial or plan ends the organisation becomes read-only; its data is deleted after 30 days unless a plan is chosen. Stackurity Cloud runs in India (DigitalOcean, Bangalore). - Enterprise: single sign-on (OpenID Connect or SAML), self-hosted licences and volume pricing; contact info@stackurity.ai. ## Links - [Home](https://stackurity.ai/) - [Pricing](https://stackurity.ai/pricing.html) - [Download the Community edition](https://stackurity.ai/download.html) - [How Stackurity protects your data](https://stackurity.ai/security.html) - [API reference](https://stackurity.ai/api.html) and [OpenAPI description](https://stackurity.ai/openapi.json) - [What's new](https://stackurity.ai/changelog.html), every release's notes, also as an [RSS feed](https://stackurity.ai/changelog.xml) - [Blog: exploited vulnerabilities and end-of-life deadlines, checked against the source advisories](https://stackurity.ai/blog/) - [Documentation](https://stackurity.ai/docs/) - [Installing](https://stackurity.ai/docs/install) - [AI assistants and MCP tools](https://stackurity.ai/docs/ai-assistants) - [API guide: authentication, roles and each area of the API](https://stackurity.ai/docs/api) - [Source code](https://github.com/stackurity/stackurity) - [Start a free trial](https://app.stackurity.dev/signup) ## Comparisons - [Stackurity vs OWASP Dependency-Track](https://stackurity.ai/compare/dependency-track): SBOM analysis compared with a live inventory of servers and apps - [An open source Snyk alternative for servers and deployed apps](https://stackurity.ai/compare/snyk-alternative) - [Trivy vs Grype vs Stackurity: scanners and the inventory above them](https://stackurity.ai/compare/trivy-grype)