A high CVSS score on something nobody is exploiting is a different problem from a mid score sitting in the KEV catalog with a remediation deadline attached. Because `vuln_lookup_cve` returns all four signals from one call, triage becomes a single question rather than four tabs. `vuln_kev_due_soon` is the one that matters if you are on a federal remediation clock.
A vulnerability intelligence server that joins four government and community sources into a single answer: NIST NVD 2.0 for CVE details and CVSS scores, the CISA Known Exploited Vulnerabilities catalog, FIRST.org EPSS for exploitation probability, and MITRE ATT&CK for adversary techniques.
- `vuln_lookup_cve` takes a `cveId` and returns NVD details, the CVSS score, KEV exploitation status, the EPSS probability and mapped ATT&CK techniques in one call
- `vuln_search` searches NVD by `keyword`, `severity` (LOW, MEDIUM, HIGH, CRITICAL), publication date range and `limit` (1-50, default 20), with `hasKev` to restrict to actively exploited entries
- `vuln_kev_latest` lists what CISA added recently — `days` defaults to 7
- `vuln_kev_due_soon` lists KEV entries whose remediation deadline falls within `days`, default 14
- `vuln_epss_top` returns the CVEs most likely to be exploited next, above a `threshold` that defaults to 0.7
- `vuln_trending` returns newly published high or critical CVEs from the last `days`, default 3
- `vuln_by_vendor` searches by `vendor` and optional `product`, cross-referencing KEV to flag what is actively exploited
Published as cybersecurity-vuln-mcp version 0.1.0. No credentials are listed for the upstream sources — NVD, CISA KEV, FIRST.org EPSS and MITRE ATT&CK are all public. Note the update cadences, because they set how fresh an answer can be: NVD is continuous, KEV and EPSS are daily, ATT&CK is quarterly.
One command — npx -y mcp-remote https://cybersecurity-vuln-mcp.apify.actor/mcp