CVE Risk MCP Server

MCP server for CVE lookups, KEV enrichment, and “what should I patch first?” ranking. It implements the MCP tools/list + tools/call flow over stdio and returns structured risk assessments per CVE.

Features

• CVE detail lookups with parsed CVSS v3/v4 metrics.
• CISA KEV feed enrichment (primary + mirror fallback).
• EPSS-style risk scoring with reasons and a priority label.
• Batch ranking for patch queues.

Tools

• cve_lookup
  • Inputs: cve_id, include_kev, include_epss
  • Output: CVE summary + KEV status + risk score
• cve_rank
  • Inputs: cve_ids, include_kev, include_epss
  • Output: ranked list (highest risk first)
• cve_patch_first
  • Inputs: cve_ids, top_n, include_kev, include_epss
  • Output: ranked list + top-N recommendations
• cve_status
  • Inputs: none
  • Output: upstream status + cache stats (timestamps + last error summary)
• cve_refresh
  • Inputs: cve_ids, include_epss, refresh_kev
  • Output: cache warm/refresh summary
• cve_export
  • Inputs: cve_ids, include_kev, include_epss, include_markdown
  • Output: ranked list + optional markdown summary

Quickstart

make setup
make check

Reliability knobs

• --retries and --retry-backoff-seconds control bounded retries for transient HTTP failures (429/5xx + network errors).
• MCP and JSON CLI responses now include structured error data for upstream failures.
• CVE parsing tolerates legacy schema variants (alternate CVSS and reference fields).
• Structured errors include remediation hints (e.g., respect Retry-After on 429s).

Run (stdio MCP server)

python -m cve_risk_mcp --stdio

Run (JSON CLI mode)

cve-risk-mcp lookup CVE-2023-23397 --pretty
cve-risk-mcp rank CVE-2023-23397 CVE-2021-44228 --pretty
cve-risk-mcp patch-first CVE-2023-23397 CVE-2021-44228 --top-n 1 --pretty
cve-risk-mcp status --pretty
cve-risk-mcp refresh --no-refresh-kev --pretty
cve-risk-mcp export CVE-2023-23397 CVE-2021-44228 --include-markdown --pretty

Output to file

cve-risk-mcp lookup CVE-2023-23397 --output out.json --pretty

NDJSON output

cve-risk-mcp rank CVE-2023-23397 CVE-2021-44228 --format ndjson

Load CVEs from file

cve-risk-mcp rank --cve-file cves.txt --format ndjson

Example (tools/call)

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"cve_lookup","arguments":{"cve_id":"CVE-2023-23397"}}}

Data sources

• CVE data: CIRCL Vulnerability Lookup API.
• KEV data: CISA Known Exploited Vulnerabilities feed (primary URL) with fallback to the official CISA GitHub mirror.
• EPSS data (optional): FIRST EPSS API.

Notes

• No authentication: intended for local or controlled environments.
• All outbound network calls are GETs to the configured APIs.