🛡️ CVE MCP Server

AI-powered security intelligence at your fingertips — 28 tools + a one-call triage_cve orchestrator, 24 data sources, one protocol.

A production-grade Model Context Protocol (MCP) server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs across NVD, EPSS, CISA KEV, Shodan, VirusTotal, and GreyNoise, ask Claude one question and get correlated intelligence in seconds. Built with Python, FastMCP, httpx, aiosqlite, Pydantic v2, and defusedxml.

The problem: Triaging a single CVE means querying NVD for CVSS scores, EPSS for exploitation probability, CISA KEV for active exploitation status, GitHub for patches, and VirusTotal for malware associations — then mentally correlating everything. For 50 CVEs, that's an entire day lost.

The solution: CVE MCP Server gives Claude direct access to 28 security tools across 24 APIs — fronted by the triage_cve one-call orchestrator. Ask "Should we patch CVE-2024-3400?" and Claude fans out to every relevant source in parallel, calculates a composite risk score (with a CISA KEV hard override), and delivers a prioritized recommendation with evidence.

---

🌍 GARS-2026 — Global Agentic AI Readiness Survey

I'm running a global academic study measuring how ready security professionals, developers, and enterprise teams actually are for agentic AI — MCP servers, tool calling, governance, and human-in-the-loop workflows.

If you use this repo, your response would be a genuinely valuable data point.

📋 Take the survey (10 min): Survey

• 60 questions · Anonymous · Supervised by SRH Berlin
• You get 50 Casky Tokens for early access to casky.ai
• Results published open access under CC-BY 4.0

---

📑 Table of contents

• Architecture
• Tool catalog
• Installation
• API keys setup
• Configuration
• Quick start
• Usage examples
• Risk score explained
• Data sources
• Running tests
• Architecture deep dive
• Security and privacy
• Troubleshooting
• Roadmap and known limitations
• Contributing
• License

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                        Claude Desktop / Claude Code                 │
│                         (MCP Client via stdio)                      │
└──────────────────────────────┬──────────────────────────────────────┘
                               │ Model Context Protocol (stdio)
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                        CVE MCP Server (Python)                      │
│  ┌─────────────┐  ┌──────────────┐  ┌───────────────┐              │
│  │  27 MCP      │  │  Composite   │  │  SQLite Cache │              │
│  │  Tools       │  │  Risk Engine │  │  + Audit Log  │              │
│  └──────┬──────┘  └──────┬───────┘  └───────┬───────┘              │
│         │                │                   │                      │
│  ┌──────┴────────────────┴───────────────────┴──────┐               │
│  │              Async HTTP Client (httpx)            │               │
│  │         Rate Limiter · Response Cache             │               │
│  └──────────────────────┬───────────────────────────┘               │
└─────────────────────────┼───────────────────────────────────────────┘
                          │ HTTPS (outbound only)
          ┌───────────────┼───────────────────────────┐
          ▼               ▼                           ▼
┌──────────────┐ ┌──────────────┐            ┌──────────────┐
│ VULNERABILITY│ │   NETWORK    │            │   THREAT     │
│ INTELLIGENCE │ │ INTELLIGENCE │            │ INTELLIGENCE │
├──────────────┤ ├──────────────┤            ├──────────────┤
│ NVD API 2.0  │ │ AbuseIPDB    │            │ VirusTotal   │
│ EPSS / FIRST │ │ GreyNoise v3 │            │ MalwareBazaar│
│ CISA KEV     │ │ Shodan       │            │ ThreatFox    │
│ OSV.dev      │ │ CIRCL PDNS   │            │ Ransomwhere  │
│ GitHub GHSA  │ │              │            │ AlienVault   │
│ MITRE ATT&CK │ │              │            │ URLScan.io   │
└──────────────┘ └──────────────┘            └──────────────┘

All traffic is outbound HTTPS only — no inbound ports are opened. API keys are loaded from environment variables and never logged. Private/internal IP addresses are blocked from all lookup tools.

---

🔍 Tool catalog (28 tools)

⭐ Orchestration (v0.2.0) — start here

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | triage_cve | One-call triage that fans out NVD + EPSS + CISA KEV (+ public PoC for depth != "quick") concurrently, computes the composite risk score with a KEV hard override, falls back to VulnCheck NVD++ when NIST NVD is throttled, and on depth="deep" emits the SSVC v2 gated decision | Free / No key (key recommended) | triage_cve("CVE-2021-44228", depth="deep") |

Also exposed via MCP primitives — Resources: kev://catalog, epss://scores/{cve_id}, manifest://tool-hash (SHA-256 over the registered tool surface, for tamper detection). Prompts: patch_decision, compare_and_prioritize, dependency_triage.

Core Vulnerability Intelligence (8 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | lookup_cve | Fetch detailed CVE record from NVD including CVSS scores, CWEs, affected products, references, and timeline | Free / No key (key recommended) | lookup_cve("CVE-2024-3400") | | search_cves | Search NVD for CVEs by keyword, product name, severity, or date range | Free / No key (key recommended) | search_cves(keyword="Apache Log4j", severity="CRITICAL") | | get_epss_score | Get EPSS exploitation probability (0–1) and percentile for one or more CVEs | Free / No key | get_epss_score("CVE-2024-3400") | | check_kev_status | Check whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog | Free / No key | check_kev_status("CVE-2021-44228") | | get_cvss_details | Parse and explain a CVSS v3.1 vector string with per-metric breakdown | Free / No key | get_cvss_details("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") | | get_cwe_info | Look up Common Weakness Enumeration details by CWE ID from embedded database | Free / No key | get_cwe_info("CWE-79") | | get_cve_references | Extract and categorize all reference links for a CVE (patches, advisories, exploits) | Free / No key (key recommended) | get_cve_references("CVE-2023-44487") | | bulk_cve_lookup | Batch-fetch details for up to 20 CVEs in a single call with parallel enrichment | Free / No key (key recommended) | bulk_cve_lookup(["CVE-2024-3400", "CVE-2023-44487"]) |

Exploit & Attack Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | search_exploits | Search GitHub for public proof-of-concept exploits and exploit code repositories | GITHUB_TOKEN (optional) | search_exploits("CVE-2024-3400") | | get_mitre_techniques | Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations | Free / No key | get_mitre_techniques("CVE-2021-44228") | | check_poc_availability | Determine if known proof-of-concept code exists for a CVE across multiple sources | GITHUB_TOKEN (optional) | check_poc_availability("CVE-2024-3400") | | get_attack_patterns | Retrieve CAPEC attack pattern details associated with a CWE or CVE | Free / No key | get_attack_patterns("CWE-89") |

Phase 3: Advanced Risk & Reporting (4 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | calculate_risk_score | Compute composite 0–100 risk score using CVSS, EPSS, KEV status, and PoC availability | Free / No key (key recommended) | calculate_risk_score("CVE-2024-3400") | | generate_risk_report | Generate a formatted executive security report for one or more CVEs with recommendations | Free / No key (key recommended) | generate_risk_report(["CVE-2024-3400", "CVE-2023-44487"]) | | prioritize_cves | Rank a list of CVEs by composite risk score for triage prioritization | Free / No key (key recommended) | prioritize_cves(["CVE-2024-3400", "CVE-2023-4966", "CVE-2023-44487"]) | | get_trending_cves | Retrieve trending CVEs based on high EPSS scores and recent KEV additions | Free / No key | get_trending_cves(days=7, min_epss=0.5) |

Network Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | lookup_ip_reputation | Check IP address abuse history and confidence score via AbuseIPDB | ABUSEIPDB_API_KEY | lookup_ip_reputation("185.220.101.34") | | check_ip_noise | Query GreyNoise for IP scan/attack activity, classification, and associated CVEs | GREYNOISE_API_KEY | check_ip_noise("185.220.101.34") | | shodan_host_lookup | Get open ports, services, banners, and vulnerabilities for an IP via Shodan | SHODAN_API_KEY | shodan_host_lookup("8.8.8.8") | | passive_dns_lookup | Retrieve historical DNS resolution data for a domain from CIRCL Passive DNS | CIRCL_PDNS_USER + CIRCL_PDNS_PASSWORD | passive_dns_lookup("example.com") |

Threat Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | virustotal_lookup | Analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines | VIRUSTOTAL_API_KEY | virustotal_lookup(hash="44d88612fea8a8f36de82e1278abb02f") | | search_malware | Search MalwareBazaar for malware samples by hash, tag, or signature | ABUSECH_AUTH_KEY (optional) | search_malware(tag="Emotet") | | search_iocs | Query ThreatFox for Indicators of Compromise linked to malware families | ABUSECH_AUTH_KEY (optional) | search_iocs(malware="CobaltStrike") | | check_ransomware | Look up ransomware payment addresses and transaction data from Ransomwhere | Free / No key | check_ransomware(address="bc1q...") |

DevSecOps (3 tools)

| Tool | Description | API Key Required | Example Usage | |------|-------------|-----------------|---------------| | scan_dependencies | Scan package names and versions against OSV.dev for known vulnerabilities | Free / No key | scan_dependencies(ecosystem="PyPI", packages={"requests": "2.28.0"}) | | scan_github_advisories | Search GitHub Security Advisories by ecosystem, package, or severity | GITHUB_TOKEN (optional) | `scan_github_advisories(e