Risky Business AI MCP Server

A comprehensive Model Context Protocol (MCP) server for cybersecurity vulnerability assessment, providing tools to search GitHub repositories, query NIST NVD, access CISA's Known Exploited Vulnerabilities catalog, and analyze repository contents for CVE research and proof-of-concept discovery.

📹 Demo

Demo

Watch Full Demo Video (MP4)

Demo Workflow

The demo demonstrates a complete vulnerability assessment for CVE-2025-53770:

✅ Validate CVE-2025-53770 and retrieve severity information from NIST
✅ Analyze business impact by checking company asset inventory
✅ Check for active exploitation in CISA KEV database
✅ Search for proof-of-concept exploits on GitHub
✅ Generate executive dashboard with findings
✅ Create and deliver voice briefing
✅ Send summary to Beeper chat

Sample Alert Message (Sent via Beeper)

🚨 CRITICAL SECURITY ALERT - CVE-2025-53770 🚨 Severity: CRITICAL (CVSS 9.8) Status: ⚠️ ACTIVELY EXPLOITED IN THE WILD Company Impact: 🔴 AFFECTED • Asset: PROD-SP-01 (SharePoint Server 2019 Enterprise) • Environment: Production • Criticality: High Threat Intelligence: • Listed in CISA KEV with known ransomware usage • Multiple proof-of-concept exploits publicly available on GitHub • Vulnerability allows unauthenticated remote code execution • This is a patch bypass for CVE-2025-49704 Immediate Actions Required: ✓ Apply Microsoft security updates IMMEDIATELY ✓ If updates cannot be applied, disconnect SharePoint from network ✓ Monitor for suspicious activity in SharePoint logs ✓ Review CISA mitigation guidance Technical Details: • CWE-502: Deserialization of Untrusted Data • Affects SharePoint 2016, 2019, and Subscription Edition • Exploitation requires network access only (no authentication) ⏰ Due Date: July 21, 2025 (per CISA BOD 22-01) Voice briefing has been generated. Please take immediate action to protect company assets.

Related MCP server: OSSInsight MCP Server

🛠️ Tools

`search_github_repositories`

Search GitHub repositories using the GitHub API.

Parameters:

query (string, required): Search query with keywords and qualifiers
sort (string, optional): Sort by "stars", "forks", "help-wanted-issues", "updated", or "best-match" (default)
order (string, optional): "desc" (default) or "asc"
per_page (integer, optional): Results per page, 1-100 (default: 5)
page (integer, optional): Page number (default: 1)

`get_cve_from_nist`

Query NIST National Vulnerability Database for CVE details.

Parameters:

cve_id (string, required): CVE identifier (e.g., "CVE-2023-1234" or "2023-1234")

Returns: CVSS scores, severity ratings, CWE mappings, affected products (CPE), and references.

`search_kev`

Search CISA's Known Exploited Vulnerabilities catalog.

Parameters:

query (string, required): Search term (CVE ID, vendor, product, or keyword)
field (string, optional): Field to search - "all", "cve_id", "vendor", "product", "vulnerability_name", "date_added" (default: "all")
max_results (integer, optional): Maximum results 1-50 (default: 10)

Returns: Matching KEV entries with exploitation details and ransomware campaign indicators.

`list_github_repository_files`

List all files in a GitHub repository.

Parameters:

repo_url (string, required): GitHub repository URL (e.g., "https://github.com/owner/repo")
branch (string, optional): Branch name (default: "main")

Returns: Complete file tree with paths, types, and SHA hashes.

`get_github_file_content`

Retrieve specific file content from a GitHub repository.

Parameters:

repo_url (string, required): GitHub repository URL
file_path (string, required): Path to file (e.g., "src/exploit.py")
branch (string, optional): Branch name (default: "main")

Returns: File content (text or binary indicator) with metadata.

📝 Prompts

`cve_repository_search`

Generate targeted search strategies for specific CVE numbers.

Parameters:

cve_number (string, required): CVE identifier (e.g., "CVE-2023-1234")
include_poc (boolean, optional): Include PoC-specific terms (default: true)

`advanced_cve_search_strategies`

Comprehensive guide for advanced CVE repository searching techniques.

📊 Resources

`kev://cisa/catalog`

Access the complete CISA Known Exploited Vulnerabilities catalog with active exploitation data.

`assets://company/inventory`

Company asset inventory for vulnerability impact assessment, including environment, criticality, and vendor information.

🚀 Quick Start

Prerequisites

Python 3.8+
uv (recommended) or pip
Optional: GitHub Personal Access Token for higher API rate limits
Optional: NIST API Key for increased rate limits

Installation

Clone the repository

git clone https://github.com/khizar-anjum/risky-business-mcp.git cd risky-business-mcp

Set up Python virtual environment

# Create a virtual environment python3 -m venv venv # Activate the virtual environment # On Linux/macOS: source venv/bin/activate # On Windows: # venv\Scripts\activate # Install dependencies pip install -r requirements.txt

Optional: Set up API authentication

# GitHub Personal Access Token from https://github.com/settings/tokens export GITHUB_TOKEN="your_github_token_here" # NIST API Key from https://nvd.nist.gov/developers/request-an-api-key export NIST_API_KEY="your_nist_api_key_here"

Running the Server

With virtual environment activated:

# Make sure the virtual environment is activated source venv/bin/activate # Linux/macOS # or # venv\Scripts\activate # Windows # Run the MCP server python main.py

Development mode (with MCP Inspector):

# With venv activated mcp dev main.py

Claude Desktop Integration

Add the server to your Claude Desktop configuration:

macOS/Linux:

code ~/Library/Application\ Support/Claude/claude_desktop_config.json

Windows:

code %APPDATA%\Claude\claude_desktop_config.json

Configuration:

{ "mcpServers": { "risky-business": { "command": "/absolute/path/to/risky-business-mcp/venv/bin/python", "args": [ "/absolute/path/to/risky-business-mcp/main.py" ], "env": { "GITHUB_TOKEN": "your_github_token_here", "NIST_API_KEY": "your_nist_api_key_here" } } } }

Environment Variables

Variable	Description	Required
`GITHUB_TOKEN`	GitHub Personal Access Token for authentication	No (but recommended)
`NIST_API_KEY`	NIST NVD API key for increased rate limits	No (optional)

🤝 Contributing

Fork the repository
Create a feature branch
Make your changes
Add tests if applicable
Submit a pull request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer: This tool is for legitimate security research and educational purposes. Users are responsible for ensuring their use complies with applicable laws and GitHub's terms of service.

Risky Business MCP Server

Risky Business AI MCP Server

📹 Demo

Demo Workflow

Sample Alert Message (Sent via Beeper)

🛠️ Tools

`search_github_repositories`

`get_cve_from_nist`

`search_kev`

`list_github_repository_files`

`get_github_file_content`

📝 Prompts

`cve_repository_search`

`advanced_cve_search_strategies`

📊 Resources

`kev://cisa/catalog`

`assets://company/inventory`

🚀 Quick Start

Prerequisites

Installation

Running the Server

Claude Desktop Integration

Environment Variables

🤝 Contributing

📄 License

Resources

Appeared in Searches

New MCP Servers

Latest Blog Posts

MCP directory API