CVE MCP Server

No entries match these filters. Clear filters

1. docs update Oct 8, 2026 · issue 097

   CVE MCP Server exposes 28 cyber tools across 24 APIs — anchored by a triage_cve orchestrator — letting Claude triage CVEs in one call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run a deep triage of a critical CVE so Claude fans out to all sources and returns an SSVC v2SSVC v2A vulnerability prioritization framework maintained by CISA and Carnegie Mellon's CERT/CC that uses decision trees to score CVEs by exploitability and impact context rather than a raw numeric score, helping triage at scale. patch decision in one call.
   copy

   $ triage_cve("CVE-2021-44228", depth="deep")

   Wire the server into Claude Desktop with all Tier 1 and Tier 2 API keys so every tool is available from chat.
   ~/Library/Application Support/Claude/claude_desktop_config.json copy

   {
     "mcpServers": {
       "cve-mcp": {
         "command": "python",
         "args": ["-m", "cve_mcp.server"],
         "cwd": "/absolute/path/to/cve-mcp-server",
         "env": {
           "NVD_API_KEY": "your-nvd-key",
           "GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxxxx",
           "ABUSEIPDB_KEY": "your-abuseipdb-key",
           "GREYNOISE_API_KEY": "your-greynoise-key",
           "SHODAN_KEY": "your-shodan-key",
           "VIRUSTOTAL_KEY": "your-virustotal-key",
           "CACHE_DB_PATH": "~/.cve-mcp/cache.db",
           "AUDIT_LOG_PATH": "~/.cve-mcp/audit.log"
         }
       }
     }
   }

   Rank a batch of CVEs by composite risk score to decide which patches to ship first.
   copy

   $ prioritize_cves(["CVE-2024-3400", "CVE-2023-4966", "CVE-2023-44487"])

   • Adds triage_cve one-call orchestrator that fans out to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. concurrently, computes a composite 0–100 risk score with a KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. hard override, falls back to VulnCheck NVD++ when NIST NVD is throttled, and emits an SSVCSSVCA decision-support framework for vulnerability prioritization, maintained by CISA and Carnegie Mellon's CERT/CC, that uses stakeholder-specific decision trees to guide patch and remediation timing instead of relying on numeric scores alone. v2 gated decision at depth='deep'.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes MCP Resources kev://catalog, epss://scores/{cve_id}, and manifest://tool-hash (SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. over the registered tool surface for tamper detection), plus Prompts patch_decision, compare_and_prioritize, and dependency_triage.
   • Adds lookup_cve, search_cves, get_epss_score, check_kev_status, get_cvss_details, get_cwe_info, get_cve_references, and bulk_cve_lookup (up to 20 CVEs per call) for core vulnerability intelligence.
   • Adds search_exploits (GitHub PoC search via GITHUB_TOKEN), get_mitre_techniques, check_poc_availability, and get_attack_patterns for exploit and attack intelligence.
   • Adds calculate_risk_score, generate_risk_report, prioritize_cves, and get_trending_cves (with days and min_epss parameters) for composite risk scoring and CVE prioritization.

   +4 more show less

   • Adds lookup_ip_reputation (AbuseIPDB via ABUSEIPDB_API_KEY), check_ip_noise (GreyNoise via GREYNOISE_API_KEY), shodan_host_lookup (via SHODAN_API_KEY), and passive_dns_lookup (CIRCL via CIRCL_PDNS_USER + CIRCL_PDNS_PASSWORD) for network intelligence.
   • Adds virustotal_lookup (70+ AV engines via VIRUSTOTAL_API_KEY), search_malware (MalwareBazaar via optional ABUSECH_AUTH_KEY), search_iocs (ThreatFox), and check_ransomware (Ransomwhere) for threat intelligence.
   • Adds scan_dependencies (OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data., with ecosystem and packages parameters), scan_github_advisories, and urlscan_check (URLScan.io via URLSCAN_API_KEY) for DevSecOps coverage.
   • Supports CACHE_DB_PATH and AUDIT_LOG_PATH environment variables to override default SQLite cache (~/.cve-mcp/cache.db) and audit log (~/.cve-mcp/audit.log) locations, plus REQUEST_TIMEOUT and MAX_RETRIES for tuning HTTP behaviour.

   9 details in Everything

2. docs update Sep 11, 2026 · issue 071

   CVE MCP Server debuts 28 tools + a triage_cve orchestrator spanning 24 APIs for one-call CVE triage via Claude⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run a deep triage on a critical CVE to get a full risk score, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. status, PoC check, and SSVC v2SSVC v2A vulnerability prioritization framework maintained by CISA and Carnegie Mellon's CERT/CC that uses decision trees to score CVEs by exploitability and impact context rather than a raw numeric score, helping triage at scale. patch decision in one call.
   copy

   $ triage_cve("CVE-2021-44228", depth="deep")

   Rank a batch of CVEs by composite risk score so a team can triage the highest-impact items first.
   copy

   $ prioritize_cves(["CVE-2024-3400", "CVE-2023-4966", "CVE-2023-44487"])

   • Adds triage_cve one-call orchestrator that fans out to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal., and public PoC sources concurrently, computes a composite 0–100 risk score with a KEV hard override, falls back to VulnCheck NVD++ when NIST NVD is throttled, and emits an SSVCSSVCA decision-support framework for vulnerability prioritization, maintained by CISA and Carnegie Mellon's CERT/CC, that uses stakeholder-specific decision trees to guide patch and remediation timing instead of relying on numeric scores alone. v2 gated decision at depth='deep'⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes MCP resources kev://catalog, epss://scores/{cve_id}, and manifest://tool-hash (SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. over the registered tool surface for tamper detection), plus MCP prompts patch_decision, compare_and_prioritize, and dependency_triage
   • Adds bulk_cve_lookup to batch-fetch details for up to 20 CVEs in a single call with parallel enrichment
   • Adds get_trending_cves to retrieve trending CVEs filtered by days and min_epss thresholds (e.g. get_trending_cves(days=7, min_epss=0.5))
   • Adds scan_dependencies to scan package names and versions against OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. for known vulnerabilities, supporting ecosystems such as PyPI

   +17 more show less

   • Adds shodan_host_lookup (requires SHODAN_API_KEY) to retrieve open ports, services, banners, and vulnerabilities for an IP via Shodan
   • Adds lookup_ip_reputation (requires ABUSEIPDB_API_KEY) to check IP abuse history and confidence score via AbuseIPDB
   • Adds passive_dns_lookup (requires CIRCL_PDNS_USER + CIRCL_PDNS_PASSWORD) to retrieve historical DNS resolution data for a domain from CIRCL Passive DNS
   • Adds virustotal_lookup (requires VIRUSTOTAL_API_KEY) to analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines
   • Adds search_malware (requires optional ABUSECH_AUTH_KEY) to search MalwareBazaar for malware samples by hash, tag, or signature
   • Adds search_iocs (requires optional ABUSECH_AUTH_KEY) to query ThreatFox for Indicators of Compromise linked to malware families
   • Adds check_ransomware to look up ransomware payment addresses and transaction data from Ransomwhere
   • Adds urlscan_check (requires URLSCAN_API_KEY) to submit a URL for scanning or retrieve previous scan results from URLScan.io
   • Adds scan_github_advisories (requires optional GITHUB_TOKEN) to search GitHub Security Advisories by ecosystem, package, or severity
   • Adds check_poc_availability to determine whether known proof-of-concept code exists for a CVE across multiple sources
   • Adds get_mitre_techniques to map a CVE or CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. to relevant MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques, tactics, and mitigations
   • Adds get_attack_patterns to retrieve CAPEC attack pattern details associated with a CWE or CVE
   • Adds calculate_risk_score to compute a composite 0–100 risk score using CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., EPSS, KEV status, and PoC availability
   • Adds generate_risk_report to produce a formatted executive security report for one or more CVEs with recommendations
   • Adds prioritize_cves to rank a list of CVEs by composite risk score for triage prioritization
   • Adds lookup_cve, search_cves, get_epss_score, check_kev_status, get_cvss_details, get_cwe_info, and get_cve_references as core vulnerability intelligence tools backed by NVD, EPSS, CISA KEV, and embedded CWE databases
   • Configures NVD rate limits via NVD_API_KEY (50 requests/30s with key vs. 5 without) and GitHub API limits via GITHUB_TOKEN (5,000 requests/hour with key vs. 60 without)

   22 details in Everything

3. docs update Sep 11, 2026 · issue 071

   CVE MCP Server: Exposes MCP prompts patch_decision, compare_and_prioritize, and dependency_triage.

   └──▷ TRY IT
   Run a full deep triage on a critical CVE to get SSVC v2SSVC v2A vulnerability prioritization framework maintained by CISA and Carnegie Mellon's CERT/CC that uses decision trees to score CVEs by exploitability and impact context rather than a raw numeric score, helping triage at scale. decision, composite risk score, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. status in one call.
   copy

   $ triage_cve("CVE-2021-44228", depth="deep")

   Rank a backlog of CVEs by composite risk score so the team patches the highest-risk issues first.
   copy

   $ prioritize_cves(["CVE-2024-3400", "CVE-2023-4966", "CVE-2023-44487"])

   Scan a Python project's dependencies against OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. to surface known vulnerabilities before a release.
   copy

   $ scan_dependencies(ecosystem="PyPI", packages={"requests": "2.28.0"})

   • Adds lookup_cve to fetch CVE records from NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. including CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores, CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes., affected products, references, and timeline.
   • Adds search_cves to search NVD by keyword, product name, severity, or date range.
   • Adds get_epss_score to retrieve EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. exploitation probability (0–1) and percentile for one or more CVEs.
   • Adds get_cvss_details to parse and explain a CVSS v3.1 vector string with per-metric breakdown.
   • Adds get_cwe_info to look up Common Weakness EnumerationCommon Weakness EnumerationCommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. details by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. ID from an embedded database.

   +7 more show less

   • Adds search_exploits to search GitHub for public proof-of-concept exploit repositories (requires GITHUB_TOKEN, optional).
   • Adds get_trending_cves to retrieve trending CVEs based on high EPSS scores and recent KEV additions, with days and min_epss parameters.
   • Adds passive_dns_lookup to retrieve historical DNS resolution data for a domain from CIRCL Passive DNS (requires CIRCL_PDNS_USER and CIRCL_PDNS_PASSWORD).
   • Adds search_malware to search MalwareBazaar for malware samples by hash, tag, or signature (requires ABUSECH_AUTH_KEY, optional).
   • Adds search_iocs to query ThreatFox for Indicators of Compromise linked to malware families (requires ABUSECH_AUTH_KEY, optional).
   • Configures NVD rate limits via NVD_API_KEY: 50 requests per 30 seconds with key vs. 5 without.
   • Configures GitHub API access via GITHUB_TOKEN: 5,000 requests/hour with token vs. 60/hour without.

   12 details in Everything

4. v0.2.0 Jun 22, 2026 · release notes

   CVE MCP Server v0.2.0 adds triage_cve orchestrator, VulnCheck fallback, SSVCSSVCA decision-support framework for vulnerability prioritization, maintained by CISA and Carnegie Mellon's CERT/CC, that uses stakeholder-specific decision trees to guide patch and remediation timing instead of relying on numeric scores alone. decisions, and streamable-HTTP transport

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.0 https://github.com/mukul975/cve-mcp-server.git
   # already have the repo? check out this version:
   $ git checkout v0.2.0

   └──▷ TRY IT
   Run a deep triage of a specific CVE, enabling SSVC decisioning via the new HTTP transport.
   copy

   $ MCP_TRANSPORT=http npx @mukul975/cve-mcp-server call triage_cve '{"cve_id": "CVE-2023-1234", "depth": "deep"}'

   Configure the server to use streamable HTTP by setting the environment variable.
   copy

   $ export MCP_TRANSPORT=http

   Fetch EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores for a CVE using the newly registered MCP Resource URI.
   copy

   $ MCP_TRANSPORT=http npx @mukul975/cve-mcp-server read epss://scores/CVE-2024-5678

   • Adds triage_cve tool as an orchestrator that fans out concurrent calls to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., EPSS, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal., and public PoC discovery to compute a composite risk score.
   • Introduces depth parameter (quick, standard, deep) for the triage_cve tool; deep mode emits an SSVC v2SSVC v2A vulnerability prioritization framework maintained by CISA and Carnegie Mellon's CERT/CC that uses decision trees to score CVEs by exploitability and impact context rather than a raw numeric score, helping triage at scale. gated decision (CISA Deployer model) with outcomes Act, Attend, or Track.
   • Adds automatic VulnCheck NVD++ fallback when NIST NVD is unreachable or throttled.
   • Implements CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. hard override logic: CVEs listed in CISA KEV are scored as CRITICAL (score clamped ≥ 76).
   • Stamps scoring_version into the triage_cve, calculate_risk_score, and health_check responses.

   +4 more show less

   • Adds MCP_TRANSPORT=http environment variable to enable streamable-HTTP transport instead of the default stdio.
   • Registers new MCP Resources: kev://catalog, epss://scores/{cve_id}, and manifest://tool-hash (SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. over registered tool surface).
   • Adds new MCP Prompts: patch_decision, compare_and_prioritize, and dependency_triage.
   • Expands the health_check endpoint to include scoring version, manifest hash, and configured-key status.

   9 details in Everything