triage_cveLABSCO SUMMARY
One question instead of fifteen tabs, with the reason attached.
The composite score is the deliverable, but the hard override is the honest part: if CISA says a vulnerability is being exploited, that outranks whatever the other signals suggest, and the recommendation says so.
What it is
A security-intelligence server that fans out across 24 vulnerability, network and threat-intelligence sources and correlates what comes back, so triage stops being fifteen browser tabs and manual reconciliation.
What you get
triage_cve— the one-call orchestrator, fanning out to NVD, EPSS and CISA KEV concurrently (plus public proof-of-concept search at deeper settings), computing a composite risk score with a KEV hard override, falling back to VulnCheck NVD++ when NIST NVD is throttled, and emitting an SSVC v2 gated decision atdepth="deep"- Core vulnerability lookups:
lookup_cve,search_cves,get_epss_score,check_kev_status,get_cvss_detailsfor parsing a CVSS v3.1 vector metric by metric,get_cwe_info,get_cve_referencescategorized into patches, advisories and exploits, andbulk_cve_lookupfor up to 20 CVEs in one call - Exploit and attack intelligence:
search_exploitsandcheck_poc_availabilityacross sources,get_mitre_techniquesmapping a CVE or CWE to ATT&CK techniques and mitigations, andget_attack_patternsfor CAPEC - Risk and reporting:
calculate_risk_scoreon a 0-100 composite,generate_risk_reportas an executive summary,prioritize_cvesto rank a list, andget_trending_cvesfrom high EPSS scores and recent KEV additions - MCP resources as well as tools —
kev://catalog,epss://scores/{cve_id}andmanifest://tool-hash, a SHA-256 over the registered tool surface for tamper detection — plus thepatch_decision,compare_and_prioritizeanddependency_triageprompts
Requirements
Python 3.10+. Most of the core tools work with no key at all. Keys raise limits and unlock sources: NVD_API_KEY takes NVD from 5 requests per 30 seconds to 50, GITHUB_TOKEN enables advisory and exploit search at 5,000 requests per hour instead of 60, and ABUSEIPDB_KEY, VIRUSTOTAL_KEY, GREYNOISE_API_KEY and SHODAN_KEY are each required for their own tools. All traffic is outbound HTTPS only — no inbound port is opened — API keys are never logged, and private and internal IP addresses are blocked from every lookup tool.
Setup effort
Build from source — clone the repository, then follow the project's own run instructions
USE CASES
01
Deciding whether to patch tonight
One call fans out to severity, exploitation probability, known-exploited status and public exploit code, and returns a prioritized recommendation with the evidence behind it.
02
Working through a scanner's output
Rank the whole list by composite risk first, then look up only the ones at the top — and batch the lookups rather than doing them one at a time.
03
Explaining a CVSS vector to someone
Parse the vector string and get a per-metric breakdown, instead of reading the letters off and hoping everyone remembers what S:C means.
04
Finding out whether exploit code exists
Search public proof-of-concept repositories and check availability across sources, which is often what turns a medium into an emergency.
05
Writing the report someone above you will read
Generate a formatted executive report over one or several CVEs, with recommendations, rather than assembling it by hand from tool output.
06
Keeping an eye on what is moving
Pull trending CVEs from high exploitation probability and recent additions to the known-exploited catalogue.
28 tools
Listed in project docs. Your client may show a different list.
lookup_cvesearch_cvesget_epss_scorecheck_kev_statusget_cvss_detailsget_cwe_infoget_cve_referencesbulk_cve_lookupsearch_exploitsget_mitre_techniquescheck_poc_availabilityget_attack_patternscalculate_risk_scoregenerate_risk_reportprioritize_cvesget_trending_cveslookup_ip_reputationcheck_ip_noiseshodan_host_lookuppassive_dns_lookupvirustotal_lookupsearch_malwaresearch_iocscheck_ransomwarescan_dependenciesscan_github_advisoriesurlscan_checkBEFORE YOU INSTALL
What to know first
Tools you get
28 tools named in the project's documentation.
Requires
Python 3.10+
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server
python -m venv venv && source venv/bin/activate
pip install -e .MCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"cve-mcp": {
"command": "<YOUR_PATH_TO_CVE_MCP_SERVER>/venv/bin/python",
"args": [
"-m",
"cve_mcp.server"
],
"cwd": "<YOUR_PATH_TO_CVE_MCP_SERVER>",
"env": {
"NVD_API_KEY": "<YOUR_NVD_API_KEY>",
"GITHUB_TOKEN": "<YOUR_GITHUB_TOKEN>",
"ABUSEIPDB_KEY": "<YOUR_ABUSEIPDB_KEY>",
"GREYNOISE_API_KEY": "<YOUR_GREYNOISE_API_KEY>",
"SHODAN_KEY": "<YOUR_SHODAN_KEY>"
}
}
}
}<YOUR_PATH_TO_CVE_MCP_SERVER> is the full path of your clone. The command is the Python inside the venv the install step created, so the client finds the installed package; on Windows it is venv\Scripts\python.exe. Delete any key you don't have — lookups against NVD, EPSS and CISA KEV work without one.
Claude Code
CLAUDE CODE · TERMINAL
claude mcp add cve-mcp -- <YOUR_PATH_TO_CVE_MCP_SERVER>/venv/bin/python -m cve_mcp.server<YOUR_PATH_TO_CVE_MCP_SERVER> is the full path of your clone (on Windows, venv\Scripts\python.exe). To pass keys, put -e NAME=value before the --, for example -e NVD_API_KEY=your_key.
MCP Inspector
MCP INSPECTOR · TERMINAL
npx @modelcontextprotocol/inspector python -m cve_mcp.server
