vuln-intel-mcp

A local MCP server that gives any AI agent — Claude Desktop, Claude Code, Cline, Cursor, or your own — CVE remediation intelligence from public sources: NVD, CISA KEV, and FIRST EPSS.

Your model does the reasoning. This server does not.

That is the whole point: the server only does the token-free work — fetching public vulnerability data over HTTP and computing an objective priority. It never calls an LLM, needs no API key, and sends nothing anywhere except read-only requests to public vulnerability databases. The remediation write-up and the ServiceNow note are produced by your model, in your session, from the structured facts the tools return. No one's API tokens are consumed but your own.

Built by Rohan Raj. A hosted demo with AI synthesis and a live cost ledger runs at clawofrohan.com/vuln-intel.

---

Install & connect

You need Python 3.10+. The easiest runner is uv (uvx downloads and runs on demand — nothing to install permanently).

Claude Code

claude mcp add vuln-intel -- uvx vuln-intel-mcp

Claude Desktop

Edit claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "vuln-intel": {
      "command": "uvx",
      "args": ["vuln-intel-mcp"]
    }
  }
}

Cline / Cursor / any MCP client

Same shape — command uvx, args ["vuln-intel-mcp"]. Or if you installed it with pip install vuln-intel-mcp, use command vuln-intel-mcp with no args.

Restart the client, and ask it something like "Should I patch CVE-2024-3400?" or "What's the exploit status of Log4Shell?"

---

Tools

Tool	What it returns (token-free)	What your model does with it
cve_lookup	NVD facts, CVSS, CWEs, affected products, fix versions from CPE data, EPSS probability, CISA KEV status, and a computed P1–P4 priority	Writes fix versions, remediation steps, workarounds, and a ServiceNow VR note
cve_search	Candidate CVEs for a free-form product/keyword query (NVD keyword search)	Picks the right CVE, then calls cve_lookup
cve_exploit_intel	Public exploit signals — KEV exploited/ransomware flags, EPSS score, and public GitHub repos referencing the CVE (often PoC/exploit code)	Judges weaponization and urgency

---

Optional environment variables

All optional — the server works with none. These raise your own public-API rate limits:

• NVD_API_KEY — a free NVD API key for higher NVD throughput.
• GITHUB_TOKEN — a GitHub token for more GitHub repo searches in cve_exploit_intel.

---

Privacy

• No telemetry. No account. No key required.
• Outbound requests go only to services.nvd.nist.gov, api.first.org, cisa.gov, and (for exploit intel) api.github.com.
• The CVE ids and search terms you look up are sent to those public services, exactly as if you visited them in a browser.

License

MIT © Rohan Raj