PatchFirst matches your server’s software against global CVEs and exploitation signals. The free check gives you a rating and highlights your stack without finding details. Specific vulnerabilities and patch priorities are part of paid monitoring.
One free, one-time check of your own server. Monitoring is paid. Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50.
What we check
Currently: OS packages, exact dependency versions and recognized products. Coverage depends on agent permissions and available data.
Available now
OS packages: Debian, Ubuntu, Alpine, the RHEL family (Rocky Linux, AlmaLinux), openSUSE and SLES.
PHP: composer.lock.
Node.js: npm (package-lock.json), Yarn v1 and Berry (yarn.lock), pnpm (pnpm-lock.yaml).
Python: poetry.lock, Pipfile.lock, uv.lock, requirements*.txt pinned with ==; installed packages in discovered venv/site-packages.
Runtime and service versions recognized through the product catalog.
Container images by name and tag; image contents are not inspected and remain a blind spot. Unknown images and floating tags need manual review.
Direct and transitive dependencies are included; dev dependencies are labeled. Discovery is limited by permissions, time, file and package counts. Inexact versions and reached limits appear as blind spots.
Coming next
Ruby: Gemfile.lock.
Go: go.sum and binary build information.
Rust: Cargo.lock.
Java: Maven/Gradle lock files and jar manifests.
These ecosystems are not checked yet.
Who it’s for
One check. Different questions.
Start with your role, from technical details to a conversation with your contractor.
Get a clear assessment and useful questions for your engineer.
From inventory to next steps.
The agent collects data on your server. PatchFirst sees which software and versions you run, not your application data.
01 / YOUR SERVER
Collect and anonymize
The agent is a single file and runs without root. Python is optional. It collects software versions and service exposure indicators. Before sending, it replaces names with UUIDs and HMAC labels, and IPs with a public-address flag. When name encryption is enabled, the name dictionary is encrypted separately.
02 / PatchFirst SERVICE
Match against threats
CVE.org and OSV help identify known vulnerabilities. CISA KEV, EPSS and exploit information add context: evidence of exploitation and the estimated likelihood of an attack.
03 / YOUR REPORT
Choose the next action
Risk combines severity, exploitability and component exposure. The free check gives you a rating from 0 to 100, a highlighted stack, and general blind spots. Paid monitoring adds finding details and P0–P3 priorities to help you plan updates.
Your names stay yours.
Anonymization hides names and addresses, but a list of software versions is still sensitive. Here is the boundary.
What the service sees
OS and package versions, recognized public images, running component information, service types and estimated exposure. Hosts appear as UUIDs and hidden values as labels.
This is enough to match software with CVEs. The service stores anonymized inventories and reports in PostgreSQL in readable form to search them and recalculate findings when vulnerability information changes.
What the agent keeps private
Direct IP addresses, original hostnames, paths, port numbers and private names covered by anonymization. Without name encryption, the agent sends no name dictionary. When encryption is enabled, a separate encrypted dictionary maps labels to names; its viewing key is never sent to the service.
Name encryption is optional. Its names password is separate from the login password. Names are decrypted in the owner’s browser. The connection IP is used only in memory for brute-force protection and is not retained.
A database copy exposes the anonymized technical stack. The service reads it for searching and recalculation, and a compromised browser or owner’s server can expose names and keys. Read about data and limitations →
You can leave names unset: the dashboard will show “Server 01”. You can also choose an alias such as web-1: it is stored openly. Do not enter a domain, IP address, company or customer name. For protection, enable name encryption in Account: your browser will move existing names into an encrypted dictionary and the service will delete the open copies.
A rating guides you. You make the call.
PatchFirst helps track known issues. It does not replace an audit, penetration test, or review of configuration and application logic.
Context changes priority
A vulnerability in an externally accessible service usually matters more than the same issue in a local component. Exposure is inferred from collected indicators and may differ from actual reachability.
A version is part of the answer
Distribution packages are checked through OSV, including backported fixes. Matching errors and delays in sources remain possible. Verify findings before making changes.
Blind spots need attention
An unknown image or floating tag does not provide a reliable version. Those components need manual review. A high rating cannot rule out unknown vulnerabilities or missed components.
One server or your fleet.
Start with a one-time snapshot. Connect an agent to send inventory regularly and follow changes over time.
One-time check
One server
Free
Run a command or paste anonymized JSON. The free result contains a rating, affected stacks, finding counts and risk signals, and general blind spots. Component names, versions and CVEs stay private.
The link works for 7 days. The server stores the report encrypted and does not keep the key: it lives only in your link.
Ongoing monitoring
Pay per server
Annual billing saves 20%: one server for a year is $28.80 instead of $36.00.
A billing month is 30 days
Server positions
Per server / month
1–5
$3.00
6–25
$2.00
26+
$1.50
Each rate applies only to servers in that tier, and the tier amounts add up. For example, 10 servers cost 5 × $3.00 + 5 × $2.00 = $25.00 per month.
An invited account’s first payment earns the inviter +1 server-month. Bonuses expire after 12 months; see the terms.
The agent reports every 6 hours and vulnerability feeds refresh every few hours. Detailed findings and patch priorities are in your dashboard; paid monitoring supports webhooks configured in Notifications.
Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50. Pay from the dashboard through available Paddle, YooKassa and CoinsSend checkouts. CoinsSend offers USDT, BTC, ETH, TON, USDC and other coins; choose the coin and network on its page and pay the network fee. There is no automatic charge.
Yes: PHP packages from composer.lock, Node.js dependencies from npm, Yarn and pnpm, and Python packages from pip and poetry when exact versions are available. Checks include direct and transitive dependencies; dev dependencies stay in the report with a label. Ruby, Go, Rust and Java are not supported yet.
For Node.js, the agent reads package-lock.json, yarn.lock and pnpm-lock.yaml; for Python, poetry.lock, Pipfile.lock, uv.lock, requirements*.txt entries with ==, and metadata from installed packages in discovered venv/site-packages. Missing or floating versions cannot be checked. Collection is bounded by access permissions, time, file and package counts; reached limits appear as blind spots.
Does PatchFirst scan other people’s servers?
No. PatchFirst never scans from outside: the agent only reads packages and listening services on the server it runs on. Install it only on servers you own or are allowed to assess.
How is the rating calculated?
Each finding gets a risk value based on severity, exploitation signals and exposure. These determine P0–P3 priorities and deductions from a starting score of 100. A P0 finding caps the score at 49. This is a prioritization model, not a probability of compromise.
What does “anonymized” mean?
Names and addresses are replaced before upload. Software versions and technical indicators remain because vulnerability matching needs them. Their combination may be recognizable, so anonymization does not promise complete anonymity.
Can I inspect what the agent sends?
Yes. The dry-run mode lets you review data before sending. For a one-time check, the JSON option lets you inspect the anonymized inventory first and then paste it into the check page.
Does an account require personal data?
No. Sign in with an invented username and password, without your name, email address or phone number. Save the recovery code: it is the only way to reset a forgotten login password. Losing both the password and code means losing access.
Payment providers receive an order number and amount without a username or payer details. CoinsSend is a custodial service and performs its own AML checks. Contacting the operator discloses your sender address. Provider information and correspondence deletion periods are described in the privacy notice.
What if I forget the names password?
If you enabled name encryption, the service does not know that password and cannot recover the names. You will need to reset name dictionaries and reconfigure the agents. The login password and names password serve different purposes.
Does a clean report mean my server is secure?
No. Sources can lag, some software may go unrecognized, and version analysis does not cover configuration or application flaws. PatchFirst does not guarantee completeness or accuracy; the owner remains responsible for updates. Service terms.
