CVE MCP Server by mukul975: Vulnerability Triage with Claude

• Gives a patch-or-not verdict for one CVE from several sources at once

  Looks up one CVE across the vulnerability database, exploit-likelihood scores, the known-exploited list and public exploit code in one go. It then scores the risk and returns a recommendation. A CVE on the known-exploited list is always scored as urgent.

  Try: “Should we patch CVE-2024-3400? Triage it.”

  Network · triage_cve

• Shows the full record for a CVE from the NVD

  Fetches one CVE from the US National Vulnerability Database with its severity scores, description and weaknesses, plus whether it is on the CISA known-exploited list.

  Try: “Look up CVE-2021-44228.”

  Network · lookup_cve

• Finds CVEs by keyword, with an optional severity filter

  Searches the NVD for a keyword such as a product name and can limit results to a severity from low to critical. It returns up to 50 results.

  Try: “Find critical CVEs mentioning Apache Struts.”

  Network · search_cves

• One-page summary of a CVE

  Builds a short briefing for one CVE, combining its NVD record with its exploit-likelihood score and known-exploited status.

  Try: “Summarize CVE-2022-22965 on one page.”

  Network · get_cve_summary

• Checks one package or version for known vulnerabilities

  Asks the OSV.dev database whether a named package, optionally at one version, has known vulnerabilities. It covers ecosystems such as PyPI, npm, Go, Maven and crates.io.

  Try: “Is lodash 4.17.15 affected by any known vulnerabilities?”

  Network · check_package_vulns

• Scans a dependency file for vulnerable packages

  Takes the pasted contents of a requirements.txt, package.json or pom.xml, or a simple name:ecosystem:version list, and returns only the packages with known vulnerabilities.

  Try: “Scan this requirements.txt for vulnerable packages.”

  Network · scan_dependencies

• Scans a container image package list for CVEs

  Checks a list of operating system packages, such as the output of dpkg -l or apk info -v, against OSV.dev and reports the ones with known vulnerabilities.

  Try: “Check these Debian packages from my image for CVEs.”

  Network · scan_container_packages

• Shows how likely a CVE is to be exploited

  Returns the Exploit Prediction Scoring System score for one or more CVEs, an estimate of how likely each is to be exploited in the wild.

  Try: “What are the EPSS scores for CVE-2021-44228 and CVE-2022-22965?”

  Network · get_epss_score

• Checks if a CVE is on the CISA known-exploited list

  Tells you whether CISA lists the CVE as exploited in real attacks.

  Try: “Is CVE-2023-4966 on the CISA KEV list?”

  Network · check_kev

• Explains a CVSS vector string in plain terms

  Breaks a CVSS vector such as CVSS:3.1/AV:N/AC:L into its parts and explains what each means.

  Try: “Explain this CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H”

  Network · parse_cvss

• Builds a timeline from publication to exploitation

  Lays out when a CVE was published, when its exploit score changed, when it joined the known-exploited list and how long patching lagged.

  Try: “Build a timeline for CVE-2021-44228.”

  Network · get_cve_timeline

• Scores a CVE from 0 to 100

  Combines severity, exploit likelihood, known-exploited status and public exploit code into one score between 0 and 100.

  Try: “Give me a risk score for CVE-2024-3400.”

  Network · calculate_risk_score

• Ranks 2 to 10 CVEs by patch priority

  Scores two to ten CVEs and ranks them so you know which to patch first.

  Try: “Which of these CVEs should we patch first: CVE-2024-3400, CVE-2023-4966, CVE-2021-44228?”

  Network · compare_cves

• Writes a vulnerability report for a CVE

  Produces a report for CVEs in one of three formats: executive, technical or full. The text is returned to the assistant, not saved as a file.

  Try: “Write an executive vulnerability report for CVE-2024-3400.”

  Network · generate_vuln_report

• Finds vendor patch advisories for a CVE

  Looks up the vendor advisories for the CVE at Microsoft, Red Hat and Ubuntu to show patch availability and affected products.

  Try: “Which vendors have published advisories for CVE-2022-22965?”

  Network · get_vendor_advisory

• Finds public exploit code on GitHub for a CVE

  Searches GitHub for public proof-of-concept repositories for the CVE and lists the most-starred first.

  Try: “Is there public exploit code for CVE-2021-44228?”

  Network · check_exploit_availability

• Looks for exploit code on GitHub, Exploit-DB and Nuclei

  Checks three sources for public exploit code for a CVE. You can switch GitHub and Exploit-DB off individually.

  Try: “Check if any PoC exists for CVE-2023-4966.”

  Network · check_poc_exists

• Maps a CVE to MITRE ATT&CK techniques and groups

  Searches the MITRE ATT&CK data for mentions of the CVE and returns the related techniques and threat groups. It downloads the ATT&CK dataset on first use and caches it for 24 hours.

  Try: “Which ATT&CK techniques relate to CVE-2021-44228?”

  Network · get_attack_mapping

• Checks an IP address for abuse and scanning activity

  Returns the abuse score, country, ISP, Tor status and scan-noise classification for an IP address. It needs AbuseIPDB and GreyNoise keys.

  Try: “Is 203.0.113.7 a known bad IP?”

  Network · check_ip_reputation

• Lists subdomains and certificate history for a domain

  Finds subdomains and certificate history for a domain from public certificate logs, plus passive DNS records if you have CIRCL access.

  Try: “What subdomains does example.com have?”

  Network · get_domain_intel

• Shows past DNS resolutions for an IP or domain

  Shows which hostnames an IP has resolved to, or which IPs a domain has pointed to. It needs CIRCL partner credentials.

  Try: “Which domains has 203.0.113.7 pointed to?”

  Network · passive_dns_lookup

• Shows open ports and services Shodan sees on an IP

  Returns what Shodan has recorded for an IPv4 address, such as open ports, services and the operating system. It needs a Shodan key.

  Try: “What does Shodan show for 8.8.8.8?”

  Network · shodan_host_lookup

• Checks a file hash against malware databases

  Looks up a file hash to find the malware family and detection counts. It needs a VirusTotal key for the VirusTotal part.

  Try: “Is this SHA256 known malware: e3b0c442...?”

  Network · lookup_file_hash

• Checks past URLScan results for a URL or domain

  Searches URLScan.io for existing scans of the URL or domain and returns the verdicts and categories. The code searches existing scans and does not submit a new one.

  Try: “Has urlscan.io flagged suspicious-site.example?”

  Network · check_url_safety

• Matches an indicator to a malware family via ThreatFox

  Looks up an IP, domain, URL or hash in ThreatFox and returns the malware family, confidence and classification if there is a match.

  Try: “Which malware family is linked to 203.0.113.7?”

  Network · lookup_malware_family

• Checks a Bitcoin address against known ransomware

  Looks the Bitcoin address up in the Ransomwhere database and names the ransomware family if it is listed.

  Try: “Is this Bitcoin address tied to ransomware?”

  Network · check_ransomware_intel

• Searches public GitHub code for exposed secrets on a topic

  Runs a GitHub code search over public repositories for a term such as a CVE ID or key name and returns matching files. It works best with a GitHub token.

  Try: “Search public GitHub for exposed files that mention CVE-2024-1234.”

  Network · scan_repo_secrets

• Checks the server, its sources and which keys are set

  Reports whether the server can reach the NVD, the state of its cache and which optional API keys are set, by name only. It pings the NVD, so do not run it in a loop.

  Try: “Run the CVE server health check.”

  Network · health_check

Watch out for

• Your lookups go to many outside services

  Each tool sends what you ask about (a CVE, IP, domain, hash or URL) to the matching service, such as AbuseIPDB, VirusTotal or Shodan. Do not query indicators from a confidential incident. github.com

• HTTP mode listens on every network interface

  If you set MCP_TRANSPORT=http, the server binds 0.0.0.0 on port 8000 by default and the code adds no sign-in. Stay on stdio, or set HOST=127.0.0.1. github.com

• It writes a cache and an audit log

  It creates a SQLite cache and a rotating audit log under ~/.cve-mcp by default, and the log keeps the parameters of every call. Change the paths with CACHE_DB_PATH and AUDIT_LOG_PATH. github.com

• One tool searches GitHub for exposed secrets

  The GitHub secrets search tool is described as for security research only. Use it only where you are authorized. github.com

• The README names one key variable wrongly

  The key table says URLSCAN_API_KEY but the code reads URLSCAN_KEY. Use URLSCAN_KEY. github.com

Security advisories