secfeed
Aggregates security intelligence feeds (vulnerabilities, news, threat intel) into a local SQLite database and provides MCP tools for AI agents to query and analyze them.
README
secfeed
Security Intelligence MCP server — aggregates authoritative vulnerability, news, and threat-intel feeds into a local SQLite database and serves them to AI agents via MCP tools.
Every ingested item is auto-classified against the agent-security-manual threat taxonomy (TH-01..TH-10), so agents can pull an AI-agent-security focused feed and trace each threat to its mitigating controls (CT), requirements (REQ), and manual chapters.
Data sources
| Category | Sources |
|---|---|
| Vulnerabilities | CISA KEV, NVD CVE API 2.0, EPSS, GitHub Security Advisories, GitHub PoC search |
| Threat intel | Abuse.ch ThreatFox, CISA Cybersecurity Advisories, arXiv cs.CR |
| News | The Hacker News, BleepingComputer, Krebs on Security, The Record, SANS ISC |
| Agent security | Simon Willison's blog, Embrace The Red |
MCP tools
| Tool | Purpose |
|---|---|
get_latest_cves |
Recent CVEs sorted by EPSS exploit probability |
get_cisa_kev |
Known Exploited Vulnerabilities (confirmed in-the-wild) |
get_security_news |
Aggregated security news |
search_security |
FTS5 full-text search across all data |
get_cve_detail |
On-demand NVD + EPSS lookup for one CVE |
get_threat_summary |
24h threat landscape briefing + feed health |
get_agent_threat_feed |
Items tagged with agent threat classes TH-01..TH-10 |
lookup_taxonomy |
Resolve TH/CT ids to controls, REQs, and manual chapters |
get_agent_security_digest |
Per-threat-class activity digest for posture review |
Agent threat taxonomy
Classification is a deterministic two-tier keyword classifier (taxonomy.py):
strong agent-specific patterns always tag; generic security terms tag only when
AI/agent context is present in the same text. No LLM calls — results are
reproducible and auditable.
| ID | Threat class |
|---|---|
| TH-01 | Prompt injection (direct / indirect) |
| TH-02 | Tool abuse / privilege escalation |
| TH-03 | RAG / knowledge-base poisoning |
| TH-04 | Memory / context contamination |
| TH-05 | Agent identity / authority abuse |
| TH-06 | Delegation / multi-agent abuse |
| TH-07 | Supply-chain / MCP / plugin compromise |
| TH-08 | Data exfiltration / secret exposure |
| TH-09 | Audit / evaluation evasion |
| TH-10 | Model / service abuse |
Deployment
docker compose up -d --build
docker logs --tail 80 secfeed
- Streamable HTTP:
http://<host>:8888/mcp(put a reverse proxy with auth in front for public exposure) - stdio mode:
python3 server.py --stdio - Data volume:
secfeed-datamounted at/data(SQLite + FTS5)
Environment variables
| Variable | Purpose |
|---|---|
NVD_API_KEY |
Optional — higher NVD API rate limits |
GITHUB_TOKEN |
Optional — higher GitHub API rate limits |
SECFEED_DB_PATH |
DB path override (default /data/secfeed.db) |
Secrets are injected via the compose environment block from the host
environment — never commit them.
Development
python3 -m venv venv && venv/bin/pip install -r requirements.txt
SECFEED_DB_PATH=/tmp/secfeed-dev.db venv/bin/python3 server.py --stdio
License
MIT
Recommended Servers
playwright-mcp
A Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.
Magic Component Platform (MCP)
An AI-powered tool that generates modern UI components from natural language descriptions, integrating with popular IDEs to streamline UI development workflow.
Audiense Insights MCP Server
Enables interaction with Audiense Insights accounts via the Model Context Protocol, facilitating the extraction and analysis of marketing insights and audience data including demographics, behavior, and influencer engagement.
VeyraX MCP
Single MCP tool to connect all your favorite tools: Gmail, Calendar and 40 more.
graphlit-mcp-server
The Model Context Protocol (MCP) Server enables integration between MCP clients and the Graphlit service. Ingest anything from Slack to Gmail to podcast feeds, in addition to web crawling, into a Graphlit project - and then retrieve relevant contents from the MCP client.
Kagi MCP Server
An MCP server that integrates Kagi search capabilities with Claude AI, enabling Claude to perform real-time web searches when answering questions that require up-to-date information.
E2B
Using MCP to run code via e2b.
Neon Database
MCP server for interacting with Neon Management API and databases
Exa Search
A Model Context Protocol (MCP) server lets AI assistants like Claude use the Exa AI Search API for web searches. This setup allows AI models to get real-time web information in a safe and controlled way.
Qdrant Server
This repository is an example of how to create a MCP server for Qdrant, a vector search engine.