CVE MCP Server

CVE MCP Server collapses the tab-hopping that makes vulnerability triage slow. Working out whether a CVE matters normally means checking NVD for the CVSS vector, EPSS for exploitation probability, CISA KEV for known active exploitation, GitHub for a proof of concept, and a threat feed for whether anything is scanning for it. This server wires all of that behind one Model Context Protocol surface so an assistant can do the fan-out itself.

The headline tool is triage_cve, which queries every relevant source in parallel and returns a prioritised recommendation with the evidence attached — the single call most users need. Behind it sit 27 more tools in six groups: vulnerability intelligence (CVE lookup, EPSS scoring, KEV status, CVSS vector parsing), exploit intelligence (GitHub PoC search, MITRE ATT&CK mapping, Exploit-DB and Nuclei template checks), risk and reporting (risk scoring, executive summaries, CVE prioritisation), network intelligence (IP reputation via AbuseIPDB, GreyNoise, Shodan and CIRCL passive DNS), threat intelligence (VirusTotal, MalwareBazaar, ThreatFox, ransomware tracking), and DevSecOps dependency scanning through OSV.dev and GitHub Advisories.

The API-key story is unusually gentle. Eight tools work with no credentials at all — NVD at its unauthenticated rate, EPSS, CISA KEV, OSV.dev, MITRE ATT&CK, CWE lookups, CVSS parsing and Ransomwhere. A free NVD key raises throughput roughly fiftyfold and a GitHub token lifts the PoC-search rate limit; free accounts at AbuseIPDB, VirusTotal, GreyNoise and Shodan unlock the network and threat tiers. Nothing in the stack requires a paid subscription.

Python 3.10+, installed from source with pip install -e ., MIT-licensed. Built by the independent maintainer mukul975 — it is not affiliated with any of the data providers it queries.