MCP Vulnerability Checker Server

A modular Model Context Protocol (MCP) server providing comprehensive security vulnerability intelligence tools including CVE lookup, EPSS scoring, CVSS calculation, exploit detection, and Python package vulnerability checking.

Demo

🔗 Using the Hosted Server

The vulnerability intelligence MCP server is already hosted and ready to use! Simply configure your MCP client to connect to it.

Claude Desktop Configuration

Add this configuration to your Claude Desktop settings file (~/.config/claude/claude_desktop_config.json):

Cursor IDE Configuration

Add this configuration to your Cursor MCP settings file (~/.cursor/mcp.json):

Alternatively, in Cursor IDE:

1. Open Cursor Settings → Features → MCP Servers

2. Click "Add New Server"

3. Select "Server-Sent Events (SSE)" as the type

4. Enter URL: https://vulnerability-intelligence-mcp-server-edb8b15494e8.herokuapp.com/sse

5. Give it a name: vulnerability-intelligence

Test the Connection

Once configured, try these example queries in Claude or Cursor:

• CVE Lookup: "Look up CVE-2021-44228" (Log4Shell vulnerability)

• EPSS Score: "Get EPSS score for CVE-2021-44228"

• Package Check: "Check the 'requests' Python package for vulnerabilities"

• Exploit Check: "Check for exploits for CVE-2021-44228"

• CVSS Calculator: "Calculate CVSS score for vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

🛡️ Available Security Tools

🔍 CVE Vulnerability Lookup (cve_lookup)

• Purpose: Fetches detailed vulnerability information from the National Vulnerability Database (NVD)

• Data Source: NIST National Vulnerability Database API 2.0

• Usage: cve_lookup cve_id="CVE-2021-44228"

• Features:

  • CVSS scores (v2.0, v3.0, v3.1) with severity ratings

  • Comprehensive vulnerability descriptions

  • References, advisories, and remediation links

  • CWE (Common Weakness Enumeration) mappings

  • Publication and modification timeline

  • Affected product configurations

📊 EPSS Score Lookup (get_epss_score)

• Purpose: Get Exploit Prediction Scoring System (EPSS) scores for CVEs

• Data Source: FIRST EPSS API

• Usage: get_epss_score cve_id="CVE-2021-44228"

• Features:

  • Probability of exploitation within 30 days

  • AI-powered risk prioritization

  • Real-time threat intelligence integration

  • Percentile rankings for relative risk assessment

🧮 CVSS Score Calculator (calculate_cvss_score)

• Purpose: Calculate CVSS base scores from vector strings

• Data Source: CVSS v3.0/v3.1 specification

• Usage: calculate_cvss_score vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

• Features:

  • Support for CVSS v3.0 and v3.1

  • Detailed metric breakdown

  • Severity level mapping (Critical, High, Medium, Low)

  • Vector string validation and parsing

🔎 Vulnerability Search (search_vulnerabilities)

• Purpose: Search vulnerability databases with advanced filtering

• Data Source: Multiple vulnerability databases (NVD, CVE)

• Usage: search_vulnerabilities keywords="apache" severity="HIGH" date_range="1y"

• Features:

  • Keyword-based search across vulnerability descriptions

  • Severity filtering (CRITICAL, HIGH, MEDIUM, LOW)

  • Date range filtering (30d, 90d, 1y, 2y, or custom)

  • Advanced query capabilities for threat research

🎯 Exploit Availability Check (get_exploit_availability)

• Purpose: Check for public exploits and proof-of-concepts (PoCs)

• Data Source: ExploitDB, Metasploit, GitHub, security advisories

• Usage: get_exploit_availability cve_id="CVE-2021-44228"

• Features:

  • Multi-source exploit detection

  • Active exploitation indicators

  • PoC code availability assessment

  • Threat intelligence aggregation

⏰ Vulnerability Timeline (get_vulnerability_timeline)

• Purpose: Get comprehensive timeline and patch status information

• Data Source: NVD, vendor advisories, security bulletins

• Usage: get_vulnerability_timeline cve_id="CVE-2021-44228"

• Features:

  • Publication and disclosure timeline

  • Patch availability status

  • Vendor advisory tracking

  • Remediation guidance timeline

🎯 VEX Status Check (get_vex_status)

• Purpose: Check Vulnerability Exploitability eXchange (VEX) status for specific products

• Data Source: Vendor VEX statements and product security advisories

• Usage: get_vex_status cve_id="CVE-2021-44228" product="Apache HTTP Server"

• Features:

  • Product-specific impact assessment

  • Vendor-provided exploitability statements

  • False positive filtering

  • Supply chain impact analysis

📦 Python Package Vulnerability Check (package_vulnerability_check)

• Purpose: Checks Python packages for known security vulnerabilities

• Data Source: OSV (Open Source Vulnerabilities) Database + PyPI

• Usage: package_vulnerability_check package_name="requests" version="2.25.1"

• Features:

  • Comprehensive vulnerability scanning for PyPI packages

  • Version-specific or all-versions checking

  • Detailed vulnerability reports with severity scores

  • Affected version ranges and fix information

  • Integration with CVE, GHSA, and PYSEC databases

  • Package metadata from PyPI

🏗️ Modular Architecture

The server is built with a clean, modular architecture:

🔧 Alternative Setup Methods

Docker Setup (Recommended for Local Development)

1. Initial setup:

2. Build and run using Docker Compose:

3. The server will be available at: http://localhost:8000/sse

4. Connect to Cursor IDE:

   • Open Cursor Settings → Features

   • Add new MCP server

   • Type: Select "sse"

   • URL: Enter http://localhost:8000/sse

Local Development Setup

1. Install the uv package manager:

2. Install dependencies and run:

3. For Cursor IDE integration (stdio mode):

   • Copy the absolute path to cursor-run-mcp-server.sh

   • Open Cursor Settings → Features → MCP Servers

   • Add new server with "stdio" type and the script path

🧪 Testing the Tools

Run the comprehensive test suite:

Example Test Outputs

CVE Lookup Test:

Package Vulnerability Test:

🌍 Environment Variables

Available environment variables (can be set in .env):

• MCP_SERVER_PORT (default: 8000) - Port to run the server on

• MCP_SERVER_HOST (default: 0.0.0.0) - Host to bind the server to

• DEBUG (default: false) - Enable debug mode

• MCP_USER_AGENT - Custom User-Agent for HTTP requests

🚀 Deploy Your Own Instance

If you want to deploy your own instance of the vulnerability intelligence server, you can use Heroku for quick deployment:

Quick Deploy to Heroku

1. Click "Deploy to Heroku" button

   

2. After deployment, your instance will be available at:

   • https://<your-app-name>.herokuapp.com/sse

3. Configure your MCP client to use your deployed instance:

   • For Claude Desktop: Update the FETCH_URL in your configuration

   • For Cursor IDE: Update the URL in your MCP settings

4. Test your deployment with the same example queries:

   • CVE Lookup: "Look up CVE-2021-44228"

   • EPSS Score: "Get EPSS score for CVE-2021-44228"

   • Package Check: "Check the 'requests' Python package for vulnerabilities"

   • Exploit Check: "Check for exploits for CVE-2021-44228"

📊 Data Sources & APIs

• CVE Data: NIST National Vulnerability Database (NVD API 2.0)

• EPSS Scores: FIRST EPSS API (Exploit Prediction Scoring System)

• CVSS Calculations: CVSS v3.0/v3.1 specification compliance

• Vulnerability Search: Multiple CVE and vulnerability databases

• Exploit Intelligence: ExploitDB, Metasploit, GitHub security advisories

• Package Vulnerabilities: OSV (Open Source Vulnerabilities)

• Package Metadata: PyPI (Python Package Index)

• VEX Data: Vendor VEX statements and product security advisories

🤝 Security Use Cases

This MCP server is designed for security engineers, developers, and teams who need:

Vulnerability Research & Intelligence

• Quick CVE lookups with comprehensive details

• CVSS and EPSS scoring for accurate risk assessment

• Advanced vulnerability search across multiple databases

• Exploit availability and threat intelligence gathering

• Timeline analysis for understanding vulnerability lifecycle

Risk Assessment & Prioritization

• EPSS-based exploitation probability scoring

• CVSS vector calculation and validation

• VEX status checking for product-specific impact

• Multi-factor risk analysis combining multiple data sources

Dependency Management

• Python package security auditing

• Version-specific vulnerability checking

• Supply chain security assessment

• Open source component risk evaluation

Security Operations & Incident Response

• Rapid vulnerability triage and classification

• Exploit availability assessment for threat modeling

• Security advisory research and correlation

• Timeline-based patch management planning

🔄 Extending the Server

The modular architecture makes it easy to add new security tools:

1. Create a new module in mcp_simple_tool/tools/

2. Export the function in tools/__init__.py

3. Register the tool in server.py

4. Add tests in tests/

See README_MODULAR.md for detailed extension guide.

📄 License

MIT License - see LICENSE file for details.