mr-ducksafe — CVE scanner for Windows software

How mr-ducksafe works

Scan & match

Knows exactly what is installed

Reads name, version and publisher from the Windows Registry Uninstall keys
Maps each program to an official CPE identifier with 50 curated mappings
Lists anything it could not recognise with --show-unmatched

Learn more

Google Chrome 148.0.7778.217cpe:2.3:a:google:chrome

AnyDesk ad 9.6.1cpe:2.3:a:anydesk:anydesk

Node.js 22.17.0cpe:2.3:a:nodejs:node.js

Adobe Acrobat Reader DC 20.012.20043cpe:2.3:a:adobe:acrobat_reader_dc

Some Internal Tool 1.2.3unmatched

NVD query

Official CVE data for your exact version

Queries the NVD CVE API 2.0 — the right source for desktop software
Compares each CVE's affected version range with what you have installed
Only anonymous {vendor, product, version} leaves your machine

Learn more

GET services.nvd.nist.gov/rest/json/cves/2.0
    ?virtualMatchString=cpe:2.3:a:google:chrome

# installed: 148.0.7778.217
✓ 12 CVEs affect this version
  1 critical · 1 high · 6 medium · 4 low

Guided report

Hundreds of CVEs, a handful of actions

Findings grouped per application, most critical first
Urgency and risk explained in plain language
A winget upgrade command or update link for every finding

Learn more

PS C:\> mr-ducksafe scan

mr-ducksafe — 14 applications need updating (525 vulnerabilities)

  CRIT  Google Chrome  148.0.7778.217
          1 critical · 1 high · 6 medium · 4 low
          Urgency: Update immediately — actively exploitable.
          Risk:    The application can be hijacked through a memory error.
          Fix:     winget upgrade --id Google.Chrome

Plain language, not jargon

Tells you what it means — and what to do

NVD records are written for security researchers. mr-ducksafe translates them into a risk you can understand and a command you can run.

NVD record

CVE-2013-6647
A use-after-free in AnimationController::endAnimationUpdate in Google Chrome before 32.0.1700.76…

mr-ducksafe

CRITGoogle Chrome

Update immediately — actively exploitable.

The application can be hijacked through a memory error.

winget upgrade --id Google.Chrome

Single binary

One .exe — no installer, no runtime, no account.

Local history

Every scan is saved to SQLite; history and prune manage it.

Zero telemetry

No machine name, user or IP is ever sent. Results stay in ~/.mr-ducksafe.

Built for your terminal and your pipeline

Fail a build when findings cross your threshold, keep the JSON report as an artifact, and read the same results as a table at your desk.

mr-ducksafemr-ducksafe scan --help

PS C:\> mr-ducksafe scan --fail-on=high --format=json -o report.json
✓ Scan complete — 143 programs
✓ Matching complete — 21 matches
✓ Done — 525 findings
Report written: report.json
PS C:\> $LASTEXITCODE
1
# high+ finding → exit 1 → pipeline 'failed'

name: cve-scan
on:
  schedule: [{ cron: "0 6 * * 1" }]
jobs:
  scan:
    runs-on: windows-latest
    steps:
      - uses: actions/setup-go@v5
        with: { go-version: "1.25" }
      - run: go install github.com/yemresalcan/mr-ducksafe/cmd/mr-ducksafe@latest
      - run: mr-ducksafe scan --fail-on=high --format=json -o report.json
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: cve-report, path: report.json }

{
  "schemaVersion": "1",
  "scanId": 15,
  "appsTotal": 143,
  "countsBySeverity": { "critical": 7, "high": 322, "medium": 163, "low": 33 },
  "findings": [
    {
      "appName": "Google Chrome",
      "appVersion": "148.0.7778.217",
      "cveId": "CVE-2013-6647",
      "severity": "critical",
      "summary": "A use-after-free in AnimationController::endAnimationUpdate ..."
    }
  ]
}

0  Success — the --fail-on threshold was not crossed
1  Threshold crossed (--fail-on) or CLI error
2  Scan error (NVD unreachable, scanner failed)

One scan, three ways to read it

Guided summary

The default view: grouped per app, most critical first, with a fix for each.

Full CVE table

--details lists every CVE; --app "Chrome" narrows it to one application.

JSON & Markdown

--format=json for scripts and CI, --format=markdown for PR comments and wikis.

Get started

Up and running in a minute

Free and open source under the MIT license. No account, no installer.

Download for Windows

Unzip the release and run one command. SHA256 checksums and an SBOM ship with every release.

.\mr-ducksafe.exe scan

Download v0.1.0 ↗

Install with Go

Have Go 1.25 or newer? Install straight from source.

go install github.com/yemresalcan/mr-ducksafe/cmd/mr-ducksafe@latest

Installation guide

Get a free NVD API key

Optional but recommended: scans get about 10× faster. Set it once and open a new terminal.

setx NVD_API_KEY "<key>"

Request a key

Why mr-ducksafe?

The Adobe Acrobat, Chrome, Office and Java on your machine — their old versions carry serious, publicly known vulnerabilities.

Nobody wants to track them by hand, and a 500-row CVE list does not tell you what to do next.

mr-ducksafe does the tracking for you, locally, and answers the only question that matters: what should I update first, and how?

Star it on GitHub

The CVE scanner that turns 525 vulnerabilities into 14 actions

How mr-ducksafe works

Knows exactly what is installed

Official CVE data for your exact version

Hundreds of CVEs, a handful of actions

Tells you what it means — and what to do

Single binary

Local history

Zero telemetry

Built for your terminal and your pipeline

One scan, three ways to read it

Guided summary

Full CVE table

JSON & Markdown

What one scan of a real developer PC looked like

Up and running in a minute

Download for Windows

Install with Go

Get a free NVD API key

Why mr-ducksafe?