LabscoMCP early access ↗
martc03MCP SERVER

Cybersecurity Vulnerability Intel MCP

One CVE lookup that returns NVD details, CISA KEV status, EPSS probability and ATT&CK techniques together.

by martc03 ↗Threat Intelligence & Digital ForensicsCommunity

LABSCO SUMMARY

Severity alone does not tell you what to patch first.

A high CVSS score on something nobody is exploiting is a different problem from a mid score sitting in the KEV catalog with a remediation deadline attached. Because vuln_lookup_cve returns all four signals from one call, triage becomes a single question rather than four tabs. vuln_kev_due_soon is the one that matters if you are on a federal remediation clock.

What it is

A vulnerability intelligence server that joins four government and community sources into a single answer: NIST NVD 2.0 for CVE details and CVSS scores, the CISA Known Exploited Vulnerabilities catalog, FIRST.org EPSS for exploitation probability, and MITRE ATT&CK for adversary techniques.

What you get

  • vuln_lookup_cve takes a cveId and returns NVD details, the CVSS score, KEV exploitation status, the EPSS probability and mapped ATT&CK techniques in one call
  • vuln_search searches NVD by keyword, severity (LOW, MEDIUM, HIGH, CRITICAL), publication date range and limit (1-50, default 20), with hasKev to restrict to actively exploited entries
  • vuln_kev_latest lists what CISA added recently — days defaults to 7
  • vuln_kev_due_soon lists KEV entries whose remediation deadline falls within days, default 14
  • vuln_epss_top returns the CVEs most likely to be exploited next, above a threshold that defaults to 0.7
  • vuln_trending returns newly published high or critical CVEs from the last days, default 3
  • vuln_by_vendor searches by vendor and optional product, cross-referencing KEV to flag what is actively exploited

Requirements

Node.js 18 or later; you clone the gov-mcp-servers repository and build this server yourself. No credentials are needed — NVD, CISA KEV, FIRST.org EPSS and MITRE ATT&CK are all public — though an optional NVD_API_KEY raises the NVD rate limit from 5 to 50 requests per 30 seconds. Note the update cadences, because they set how fresh an answer can be: NVD is continuous, KEV and EPSS are daily, ATT&CK is quarterly.

Setup effort

Build from source — git clone https://github.com/martc03/gov-mcp-servers.git

See installation options