Pix connects your coding agent to Vulnetix VDB: 160 upstream sources — CVE, GHSA, OSV, vendor advisories and more — aggregated, normalised, and enriched with exploit intelligence, malware associations and safe upgrade paths.
Three hooks watch the moments that matter, and eighteen skills cover the work that needs your working tree. Looking a vulnerability up is not in here — that is the MCP server and the CLI’s own subcommands, so a question has one answer rather than three competing descriptions of the same job.
Free to start on the Community tier. No credential at all still works: reads succeed, the rate limit is shared, and your agent is told so in plain words rather than shown an error.
The shape of it
There are two surfaces and they do different jobs.
MCP is the data surface — 31 tools, already shaped, no install, reachable from any client that speaks the protocol.
The CLI is the local surface, and the only one that can read a working tree, edit a manifest, or run with no credentials. A hook is a process rather than an agent turn, so hooks are always CLI.
Skills sit on top of both and follow one rule: use the MCP tools if the agent has them, the CLI otherwise. That is written down once, in the skill contract, and never restated.