Vulert

Vulert is a software composition analysis (SCA) service, originally launched in 2022 under Devnack Ltd and reincorporated in 2025 as Vulert Ltd in London. The Vulert Scanner checks dependency manifest files such as package-lock.json, and a companion Docker SCA feature checks container images, cross-referencing the GitHub Advisory Database, Google’s OSV, the NVD, and language-specific advisory feeds to flag known vulnerabilities in real time.

The product’s core pitch is that it works agentlessly, from manifest files alone, without requiring access to source code or installation of a scanning agent inside a customer’s environment — a lower-friction entry point than agent-based SCA tools. The company has also added an MCP server aimed at AI coding agents and CI/CD integrations, keeping pace with how development workflows are shifting toward agentic tooling. It reports more than 1,000 registered users, concentrated in fintech and healthtech, though it names no specific customers and discloses no funding.

SCA is a mature and crowded category dominated by much larger, better-funded players (Snyk, Socket, GitHub Dependabot), so Vulert’s manifest-only approach is a useful convenience rather than a structural change to how dependency risk is managed.