<div align="center">

🛰️ security-intel-mcp

A Model Context Protocol (MCP) server that gives Claude real vulnerability intelligence — CVE lookup (NVD), EPSS exploit-probability, and CISA KEV status — from free public APIs. No API key required.

</div>

---

📖 What this is

When triaging a vulnerability, three questions matter: what is it, how likely is it to be exploited, and is it already being exploited in the wild? This MCP server answers all three from authoritative free sources, so an AI assistant can prioritize CVEs by real-world risk — not CVSS alone.

🧰 Tools

Tool	Source	Returns
cve_lookup(cve_id)	NVD	Description, publish date, CVSS severity
epss_score(cve_id)	FIRST EPSS	Probability of exploitation (next 30 days) + percentile
kev_check(cve_id)	CISA KEV	Whether it's known-exploited, with due date & required action
cve_enrich(cve_id)	all three	One combined, prioritized risk view

cve_enrich applies a transparent rule: KEV > high EPSS > high CVSS — the same logic a good vulnerability-management program uses.

⚙️ Install

git clone https://github.com/devsecforge/security-intel-mcp.git
cd security-intel-mcp
pip install -r requirements.txt

▶️ Use with Claude Desktop

Add to your claude_desktop_config.json (see examples/):

{
  "mcpServers": {
    "security-intel": {
      "command": "python",
      "args": ["/absolute/path/to/security-intel-mcp/server.py"]
    }
  }
}

Restart Claude Desktop, then ask: "Enrich CVE-2021-44228 and tell me if I should patch it now." Claude will call cve_enrich and answer with NVD, EPSS, and KEV data.

🧪 Run standalone

python server.py    # starts the MCP server over stdio

🔒 Notes

• Uses public, unauthenticated endpoints; be mindful of NVD rate limits for bulk use.
• Read-only intelligence — the server takes no actions and stores nothing.

🤝 Contributing & License

See CONTRIBUTING.md. MIT © 2026 devsecforge (S. Naz). Original work.