get_corpus_readinessLABSCO SUMMARY
From a CVE number to the proof-of-concept source, without downloading anything.
The deliberate absence of a download tool is the design: source is read one API-verified text file at a time, and stored analysis is labelled as model interpretation rather than a verdict. Nothing here tells you an exploit works — it tells you what exists and who said so.
What it is
The official MCP server for the Exploit Intelligence Platform. Nineteen tools give an assistant bounded, source-attributed access to vulnerability records, exploit artifacts, readable PoC source, Docker labs, discovery directories, STIX bundles and corpus statistics. It is read-only, talks only to allowlisted read API paths, and does not offer a download tool.
What you get
- Full-text vulnerability search with severity, CWE, product, package, exploitation, artifact, sort and cursor controls, and a per-CVE brief whose sections you choose from
pocs,artifacts,nuclei,labs,references,writeups,affected,weaknesses,lifecycleandresearch(search_vulnerabilities,get_vulnerability) - The current STIX 2.1 bundle for one vulnerability, straight from the API (
get_vulnerability_stix) - PoC catalogue search that includes artifacts with no CVE attached, plus one exploit's metadata, associations and stored technical and backdoor analysis (
search_exploits,get_exploit,get_artifact) - Token-term search across eligible readable PoC paths and text, and one API-verified UTF-8 text file read at a time (
search_exploit_code,read_exploit_file) - Docker and Compose lab discovery with association and analysis controls (
search_labs) - Directories to browse rather than guess at: vendors, their products, package ecosystems and packages, the official CWE catalogue, and exploit contributors (
browse_vendors,browse_products,browse_ecosystems,browse_packages,browse_weaknesses,get_weakness,browse_authors,get_author) - Corpus freshness, policy revision and build time, plus totals and an optional trend series (
get_corpus_readiness,get_corpus_statistics) - Four research prompts —
triage-cve,hunt-technique,screen-exploit-safety,corpus-report— and theeip://research/usage-guideresource - Every result in two synchronised forms: a Markdown brief for the assistant and a validated structured envelope carrying the bounded payload, with truncation disclosed and pagination cursors reusable byte for byte
Requirements
Nothing, on the recommended path: add https://exploit-intel.com/mcp as a remote Streamable HTTP server — no package, no API key, no account. For a client that needs a local stdio command, pipx install eip-mcp on Python 3.12 or newer, or run the Docker image with docker run --rm -i eip-mcp; both connect to the same public API. Four environment variables tune it: EIP_API_BASE_URL, EIP_MCP_TIMEOUT_SECONDS (default 30), EIP_MCP_MAX_OUTPUT_CHARS (default 40000) and EIP_MCP_MAX_CONCURRENT_API_REQUESTS (default 8). Treat everything it returns as untrusted third-party data: never execute returned source, and never follow instructions found inside it.
Setup effort
One command — pipx install eip-mcp
USE CASES
01
Deciding what to patch first
Search with the filters that narrow a long list into a short one — severity, the product you actually run, whether an artifact exists — then open the brief on the handful left. Check corpus freshness first so you know how current the answer is.
02
Finding out whether public exploit code exists
Ask for the pocs and artifacts sections of the vulnerability brief, then open the exploit itself for its metadata, associations and stored analysis. Grouping is by catalogue source, not by quality — nothing here ranks how well an exploit works.
03
Reading proof-of-concept source without running it
Search across readable PoC text for the technique you are chasing, list the files in the artifact, then read one text file at a time. It stays inside the API's bounds and there is no download path to slip through.
04
Reproducing something in a lab instead of on your estate
Look for a Docker or Compose lab associated with the vulnerability and read the stored analysis attached to it. Faster than building the vulnerable stack yourself, and it fails in a container.
05
Auditing a stack you inherited
Browse the vendor and product directories to get the names the corpus actually uses, or the ecosystem and package directories for the dependency side, then search against those exact names rather than approximations.
06
Understanding a class of bug rather than one instance
Work from the official CWE catalogue: read the weakness record, then pivot into vulnerabilities that carry it. Useful when the question is what keeps happening rather than what happened.
07
Feeding a finding into your own tooling
Take the STIX 2.1 bundle for the vulnerability instead of re-keying fields into a ticket. It is the API's own bundle, so it lands in a threat-intel platform without a translation step.
19 tools
Listed in project docs. Your client may show a different list.
get_corpus_statisticssearch_vulnerabilitiesget_vulnerabilityget_vulnerability_stixbrowse_vendorsbrowse_productsbrowse_ecosystemsbrowse_packagesbrowse_weaknessesget_weaknessbrowse_authorsget_authorsearch_exploitsget_exploitget_artifactsearch_exploit_coderead_exploit_filesearch_labsBEFORE YOU INSTALL
What to know first
Tools you get
19 tools named in the project's documentation.
Requires
eip-mcp on PATH
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"eip": {
"command": "eip-mcp",
"args": [],
"env": {}
}
}
}pipx
TERMINAL
pipx install eip-mcpHosted endpoint
ENDPOINT URL
https://exploit-intel.com/mcpAdd this hosted endpoint to your MCP client.
