Labsco
MCP SERVER

CVE MCP Server

by mukul975 ↗

Ask whether a CVE is worth patching and get one answer — NVD severity, EPSS probability, CISA KEV status and public exploit availability, correlated into a scored recommendation.

Threat Intelligence & Digital Forensics
Summary
One question instead of fifteen tabs, with the reason attached.

The composite score is the deliverable, but the hard override is the honest part: if CISA says a vulnerability is being exploited, that outranks whatever the other signals suggest, and the recommendation says so.

What it is

A security-intelligence server that fans out across 24 vulnerability, network and threat-intelligence sources and correlates what comes back, so triage stops being fifteen browser tabs and manual reconciliation.

What you get
  • `triage_cve` — the one-call orchestrator, fanning out to NVD, EPSS and CISA KEV concurrently (plus public proof-of-concept search at deeper settings), computing a composite risk score with a KEV hard override, falling back to VulnCheck NVD++ when NIST NVD is throttled, and emitting an SSVC v2 gated decision at `depth="deep"`
  • Core vulnerability lookups: `lookup_cve`, `search_cves`, `get_epss_score`, `check_kev_status`, `get_cvss_details` for parsing a CVSS v3.1 vector metric by metric, `get_cwe_info`, `get_cve_references` categorized into patches, advisories and exploits, and `bulk_cve_lookup` for up to 20 CVEs in one call
  • Exploit and attack intelligence: `search_exploits` and `check_poc_availability` across sources, `get_mitre_techniques` mapping a CVE or CWE to ATT&CK techniques and mitigations, and `get_attack_patterns` for CAPEC
  • Risk and reporting: `calculate_risk_score` on a 0-100 composite, `generate_risk_report` as an executive summary, `prioritize_cves` to rank a list, and `get_trending_cves` from high EPSS scores and recent KEV additions
  • MCP resources as well as tools — `kev://catalog`, `epss://scores/{cve_id}` and `manifest://tool-hash`, a SHA-256 over the registered tool surface for tamper detection — plus the `patch_decision`, `compare_and_prioritize` and `dependency_triage` prompts
Requirements

Python 3.10+. Most of the core tools work with no key at all. Keys raise limits and unlock sources: `NVD_API_KEY` takes NVD from 5 requests per 30 seconds to 50, `GITHUB_TOKEN` enables advisory and exploit search at 5,000 requests per hour instead of 60, and `ABUSEIPDB_KEY`, `VIRUSTOTAL_KEY`, `GREYNOISE_API_KEY` and `SHODAN_KEY` are each required for their own tools. All traffic is outbound HTTPS only — no inbound port is opened — API keys are never logged, and private and internal IP addresses are blocked from every lookup tool.

Setup effort

Build from source — clone the repository and build it, then point your client at the binary