mukul975/cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

What it solves

Triaging vulnerabilities (CVEs) typically requires security analysts to manually query multiple disparate data sources—such as NVD for severity, EPSS for exploitation probability, and CISA KEV for active exploitation status—and then mentally correlate that data. This process is time-consuming and inefficient, especially when dealing with dozens of CVEs.

How it works

This project is a Model Context Protocol (MCP) server that integrates 28 security tools across 24 APIs into a single interface for AI clients like Claude. It uses an asynchronous HTTP client (httpx) and a SQLite cache to fetch and correlate data from vulnerability, network, and threat intelligence sources. A central orchestrator tool, triage_cve, can automatically fan out requests to multiple sources in parallel to calculate a composite risk score and provide a prioritized patching recommendation.

Who it’s for

Security professionals, developers, and enterprise teams who need to quickly analyze and prioritize vulnerabilities in their software stack.

Highlights

  • Comprehensive Toolset: 28 tools covering vulnerability intelligence (NVD, EPSS, CISA KEV), exploit intelligence (GitHub PoCs, MITRE ATT&CK), network intelligence (Shodan, GreyNoise), and threat intelligence (VirusTotal, MalwareBazaar).
  • One-Call Orchestration: The triage_cve tool automates the correlation of multiple data sources into a single risk assessment.
  • Composite Risk Engine: Calculates a 0–100 risk score based on CVSS, EPSS, KEV status, and PoC availability.
  • Flexible API Key Tiers: Supports a "zero-key start" for free tools, with optional tiers for enhanced performance and deeper intelligence.

Related

  • Project
    bvisible/mcp-ssh-manager

    An MCP server that enables AI agents to securely manage multiple SSH remote servers, execute commands, and automate DevOps tasks with per-server security restrictions.

  • Project
    badchars/darknet-mcp-server

    darknet‑mcp‑server is a self‑hosted MCP server that wraps 66 security‑tool APIs (HIBP, ThreatFox, ransomware trackers, Tor onion search, blockchain intel, etc.) into a single endpoint. AI agents can call these tools conversationally to get breach, ransomware, dark‑web, malware and IP reputation data in one unified response, dramatically reducing the manual, multi‑tab workflow of traditional investigations.

  • Project
    vmoranv/jshookmcp

    An MCP server that provides AI agents with a comprehensive suite of reverse-engineering tools for JavaScript, WASM, and native processes, featuring an adaptive tool-discovery system to manage token usage.

  • Project
    mcpdotdirect/evm-mcp-server

    An MCP server that enables AI agents to interact with 60+ EVM-compatible blockchains, providing tools for token transfers, smart contract interaction with automatic ABI fetching, and ENS resolution.

  • Project
    spences10/mcp-omnisearch

    An MCP server that provides unified access to multiple web search, AI search, and web extraction tools including Tavily, Brave, Kagi, and Firecrawl.