mukul975/cve-mcp-server

git clone https://github.com/mukul975/cve-mcp-server.git && cd cve-mcp-server
python -m venv venv && source venv/bin/activate && pip install -e .
cp .env.example .env  (add API keys)
Claude Code: `claude mcp add cve-mcp -- python -m cve_mcp.server` (repeat -e for each key)

Usage

• •Ask questions like 'What is CVE-2021-44228? Is it actively exploited?' — Claude calls lookup_cve (NVD), get_epss_score (EPSS), check_kev_status (CISA KEV), all free without keys
• •One-call triage: `triage_cve("CVE-2021-44228", depth="deep")` fans out NVD + EPSS + KEV + PoC concurrently and emits a composite score (with SSVC v2 decision at depth=deep)
• •Scan dependencies: scan_dependencies(ecosystem="PyPI", packages={"requests": "2.28.0"}) via OSV.dev
• •Configure Claude Desktop with absolute paths in claude_desktop_config.json and fully quit/restart it

Key features

• ✓28 tools: triage_cve orchestrator, NVD lookup/search/bulk lookup, EPSS, CISA KEV, CVSS v3.1 parser, CWE, MITRE ATT&CK/CAPEC, PoC availability, risk score, executive reports, IP/GreyNoise/Shodan/passive DNS, VirusTotal/MalwareBazaar/ThreatFox/ransomware, dependency scanning, URLScan
• ✓Composite risk score (CVSS 20% + EPSS 35% + KEV 30% + PoC 15%) with CISA KEV hard override (score >= 76, always CRITICAL)
• ✓24 data sources with SQLite caching per-key TTL and rotating audit log (keys never logged)
• ✓Security: outbound HTTPS only, private-IP blocking, defusedxml, no sampling handler registered
• ✓Optional HTTP transport (MCP_TRANSPORT=http) and Dockerfile; MCP resources (kev://catalog) and prompts (patch_decision)

Best for

Security teams and developers who want to triage CVEs, scan dependencies, and investigate IPs/IOCs by asking Claude instead of opening 15 browser tabs.

Caveats

• ⚠Many tools need API keys (Tier 1: NVD_API_KEY, GITHUB_TOKEN; Tier 2: AbuseIPDB, VirusTotal, GreyNoise, Shodan; Tier 3: URLScan, CIRCL) — 8 tools work keyless
• ⚠Intelligence/lookup only: no active scanning, no write operations (except URLScan submissions)
• ⚠No CVSS v4.0 calculator (v3.1 only; NVD v4.0 scores displayed but not recalculated); NVD max 2,000 results/query; EPSS may not exist for CVEs < 24h old
• ⚠CISA KEV updates only on US business days; GreyNoise community tier is 50 queries/week; VirusTotal free tier 4 req/min; CIRCL PDNS requires partner registration