improv.sh vs VulnFeed

improv.sh and VulnFeed are both cli coding agents tracked by AIDiveForge. Below is a side-by-side comparison of pricing, capabilities, platforms, and ownership — sourced from each tool's live website and verified before publishing.

improv.sh

improv operates as a task harness: the @im call pulls repo context, detects your test commands, writes acceptance criteria, and packages shell validation steps into one spec the agent can implement on turn one. The loop infrastructure is the distinguishing piece — judges run your actual exit-code commands (npm test, typecheck, build), so done means your tests pass, not that the agent says it's done. The tool installs locally via curl with no external API keys required, and the Chrome extension brings the same engine into web-based chat interfaces. The 920-skill library and daily auto-research loop suggest the routing layer will keep growing — but the page offers no independent benchmarks to validate the token-savings figures cited.

VulnFeed

VulnFeed is an MCP server that reads your lockfile directly, cross-references NVD and GitHub Advisories against only the packages you ship, and surfaces results ranked by EPSS — the exploit probability score that separates CVEs attackers are actually using from the ones sitting dormant for years. It runs locally via a single uvx command and feeds results into Claude Code, Cursor, VS Code, or Windsurf. The free tier caps at 10 scans per day and one monitored project; teams that scan frequently or monitor multiple repos will hit that ceiling fast. At that point, the choice is a paid upgrade or a full migration to something like Snyk, which adds code-level remediation context VulnFeed does not provide.

Attribute	improv.sh	VulnFeed
Pricing	Free	Paid
Price	—	$14/mo
Free trial	No	No
Open source	Yes	No
Has API	No	Yes
Self-hosted option	Yes	Yes
Platforms	VS Code, Cursor, Claude Code, terminal, Chrome	Claude Code, Claude Desktop, Cursor, VS Code, Windsurf
Pros	Repo-aware spec compilation pulls your actual test commands and package scripts into the task before the agent starts, which means the agent implements against your real constraints instead of inventing them mid-run. Exit-code judges close the loop on real shell commands — npm test, typecheck, build — so you are not relying on the agent's self-assessment of whether it finished. Task memory persisted under .improv/tasks/ survives session boundaries, so an agent restarted mid-task picks up status and spec instead of starting the discovery cycle again. Local-first install with no external API keys required, which means the harness runs in air-gapped or locked-down environments where cloud tooling is blocked. Chrome extension and VS Code/Cursor Marketplace extension share the same local engine, so the spec compilation and judge loop work whether you are in the IDE or a browser-based chat interface — without switching tabs.	Reads your actual lockfile rather than scanning the full language ecosystem, which means you see only CVEs that affect packages you ship — not hundreds of irrelevant hits from packages you never installed. EPSS scoring surfaces CVEs by real-world exploit probability alongside severity, so you patch the vulnerability attackers are using instead of the one with the highest CVSS number that has sat unexercised for three years. Returns the exact upgrade version per package rather than stopping at 'you are vulnerable,' which means the fix is actionable inside the same conversation with your AI client. Continuous monitoring indexes new CVEs shortly after publication, so a vulnerability disclosed overnight appears in results at your next morning session rather than at your next scheduled scan. Flat-rate paid tier is not per-seat or per-repo, which means a team adding a second developer or a third project does not trigger a pricing jump.
Cons	Task state is written to .improv/tasks/ on the local machine. Teams with more than one developer working the same codebase have no shared task state — there is no sync layer described on the page — so parallel agent runs on different machines produce divergent task records with no reconciliation path. The tool exposes no API surface, so teams that want to trigger improv from a CI pipeline or wrap it in a custom orchestration layer cannot. Teams hitting this wall move to harness frameworks that expose programmatic interfaces — at which point they are maintaining the prompt compilation logic themselves. The token-savings figures on the page (~613 tokens median) are vendor-reported with no independent reproduction methodology described. Teams making adoption decisions based on cost reduction should treat these numbers as illustrative until they run their own baseline comparison. Chrome extension installation requires either the Chrome Web Store or a manual sideload script — neither path is available in Firefox or Safari. Teams on non-Chromium browsers are limited to the terminal install, losing the browser chat integration entirely.	The free tier caps at 10 scans per day and one monitored project — a developer running scans across multiple services or triggering scans on file save will exhaust the daily quota before noon, at which point scanning stops until the counter resets. VulnFeed identifies vulnerable versions and recommends upgrade targets but provides no code-level remediation: no PR generation, no inline diff, no analysis of whether your specific call path reaches the vulnerable function. Teams that need that layer move to Snyk or Socket, both of which offer it — at significantly higher per-developer cost. The tool set covers scanning, CVE lookup, monitoring, and alerts, but there is no policy enforcement layer. Teams that need to fail a build when a CRITICAL CVE with high EPSS is introduced have to wire that logic themselves outside VulnFeed.

Bottom line

Improv.sh is free while VulnFeed is paid; improv.sh is open source; only VulnFeed exposes a public API. Choose based on which difference matters most for your workflow.

Frequently asked questions

What is the difference between improv.sh and VulnFeed?

improv.sh is Free and open source, while VulnFeed is Paid. Compare pricing, free trial, API, platforms, and pros/cons in the table above on AIDiveForge.

Is improv.sh better than VulnFeed?

It depends on your workflow. Use the side-by-side attributes (pricing, open source, API, self-hosted, platforms) to decide. AIDiveForge does not rank a universal winner — we publish verified facts so you can choose.