Risky Business MCP Server

Risky Business AI MCP Server

A comprehensive Model Context Protocol (MCP) server for cybersecurity vulnerability assessment, providing tools to search GitHub repositories, query NIST NVD, access CISA's Known Exploited Vulnerabilities catalog, and analyze repository contents for CVE research and proof-of-concept discovery.

📹 Demo

Demo

Watch Full Demo Video (MP4)

Demo Workflow

The demo demonstrates a complete vulnerability assessment for CVE-2025-53770:

✅ Validate CVE-2025-53770 and retrieve severity information from NIST
✅ Analyze business impact by checking company asset inventory
✅ Check for active exploitation in CISA KEV database
✅ Search for proof-of-concept exploits on GitHub
✅ Generate executive dashboard with findings
✅ Create and deliver voice briefing
✅ Send summary to Beeper chat

Sample Alert Message (Sent via Beeper)

🚨 CRITICAL SECURITY ALERT - CVE-2025-53770 🚨

Severity: CRITICAL (CVSS 9.8)
Status: ⚠️ ACTIVELY EXPLOITED IN THE WILD

Company Impact: 🔴 AFFECTED
• Asset: PROD-SP-01 (SharePoint Server 2019 Enterprise)
• Environment: Production
• Criticality: High

Threat Intelligence:
• Listed in CISA KEV with known ransomware usage
• Multiple proof-of-concept exploits publicly available on GitHub
• Vulnerability allows unauthenticated remote code execution
• This is a patch bypass for CVE-2025-49704

Immediate Actions Required:
✓ Apply Microsoft security updates IMMEDIATELY
✓ If updates cannot be applied, disconnect SharePoint from network
✓ Monitor for suspicious activity in SharePoint logs
✓ Review CISA mitigation guidance

Technical Details:
• CWE-502: Deserialization of Untrusted Data
• Affects SharePoint 2016, 2019, and Subscription Edition
• Exploitation requires network access only (no authentication)

⏰ Due Date: July 21, 2025 (per CISA BOD 22-01)

Voice briefing has been generated. Please take immediate action to protect company assets.

🛠️ Tools

`search_github_repositories`

Search GitHub repositories using the GitHub API.

Parameters:

query (string, required): Search query with keywords and qualifiers
sort (string, optional): Sort by "stars", "forks", "help-wanted-issues", "updated", or "best-match" (default)
order (string, optional): "desc" (default) or "asc"
per_page (integer, optional): Results per page, 1-100 (default: 5)
page (integer, optional): Page number (default: 1)

`get_cve_from_nist`

Query NIST National Vulnerability Database for CVE details.

Parameters:

cve_id (string, required): CVE identifier (e.g., "CVE-2023-1234" or "2023-1234")

Returns: CVSS scores, severity ratings, CWE mappings, affected products (CPE), and references.

`search_kev`

Search CISA's Known Exploited Vulnerabilities catalog.

Parameters:

query (string, required): Search term (CVE ID, vendor, product, or keyword)
field (string, optional): Field to search - "all", "cve_id", "vendor", "product", "vulnerability_name", "date_added" (default: "all")
max_results (integer, optional): Maximum results 1-50 (default: 10)

Returns: Matching KEV entries with exploitation details and ransomware campaign indicators.

`list_github_repository_files`

List all files in a GitHub repository.

Parameters:

repo_url (string, required): GitHub repository URL (e.g., "https://github.com/owner/repo")
branch (string, optional): Branch name (default: "main")

Returns: Complete file tree with paths, types, and SHA hashes.

`get_github_file_content`

Retrieve specific file content from a GitHub repository.

Parameters:

repo_url (string, required): GitHub repository URL
file_path (string, required): Path to file (e.g., "src/exploit.py")
branch (string, optional): Branch name (default: "main")

Returns: File content (text or binary indicator) with metadata.

📝 Prompts

`cve_repository_search`

Generate targeted search strategies for specific CVE numbers.

Parameters:

cve_number (string, required): CVE identifier (e.g., "CVE-2023-1234")
include_poc (boolean, optional): Include PoC-specific terms (default: true)

`advanced_cve_search_strategies`

Comprehensive guide for advanced CVE repository searching techniques.

📊 Resources

`kev://cisa/catalog`

Access the complete CISA Known Exploited Vulnerabilities catalog with active exploitation data.

`assets://company/inventory`

Company asset inventory for vulnerability impact assessment, including environment, criticality, and vendor information.

🚀 Quick Start

Prerequisites

Python 3.8+
uv (recommended) or pip
Optional: GitHub Personal Access Token for higher API rate limits
Optional: NIST API Key for increased rate limits

Installation

Clone the repository

git clone https://github.com/khizar-anjum/risky-business-mcp.git
cd risky-business-mcp

Set up Python virtual environment

# Create a virtual environment
python3 -m venv venv

# Activate the virtual environment
# On Linux/macOS:
source venv/bin/activate
# On Windows:
# venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

Optional: Set up API authentication

# GitHub Personal Access Token from https://github.com/settings/tokens
export GITHUB_TOKEN="your_github_token_here"

# NIST API Key from https://nvd.nist.gov/developers/request-an-api-key
export NIST_API_KEY="your_nist_api_key_here"

Running the Server

With virtual environment activated:

# Make sure the virtual environment is activated
source venv/bin/activate  # Linux/macOS
# or
# venv\Scripts\activate  # Windows

# Run the MCP server
python main.py

Development mode (with MCP Inspector):

# With venv activated
mcp dev main.py

Claude Desktop Integration

Add the server to your Claude Desktop configuration:

macOS/Linux:

code ~/Library/Application\ Support/Claude/claude_desktop_config.json

Windows:

code %APPDATA%\Claude\claude_desktop_config.json

Configuration:

{
  "mcpServers": {
    "risky-business": {
      "command": "/absolute/path/to/risky-business-mcp/venv/bin/python",
      "args": [
        "/absolute/path/to/risky-business-mcp/main.py"
      ],
      "env": {
        "GITHUB_TOKEN": "your_github_token_here",
        "NIST_API_KEY": "your_nist_api_key_here"
      }
    }
  }
}

Environment Variables

Variable	Description	Required
`GITHUB_TOKEN`	GitHub Personal Access Token for authentication	No (but recommended)
`NIST_API_KEY`	NIST NVD API key for increased rate limits	No (optional)

🤝 Contributing

Fork the repository
Create a feature branch
Make your changes
Add tests if applicable
Submit a pull request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer: This tool is for legitimate security research and educational purposes. Users are responsible for ensuring their use complies with applicable laws and GitHub's terms of service.

This server cannot be installed

security - not tested

license - not found

quality - not tested

How are these scores calculated?

remote-capable server

The server can be hosted and run remotely because it primarily relies on remote services or has no dependency on the local environment.

Enables comprehensive cybersecurity vulnerability assessment by searching GitHub repositories for exploits, querying NIST NVD for CVE details, and accessing CISA's Known Exploited Vulnerabilities catalog. Supports complete vulnerability research workflows from threat intelligence gathering to proof-of-concept discovery.

Related MCP Servers

MCP Server Pentest
9olidity
A
security
A
license
A
quality
A security testing tool that enables automated vulnerability detection including XSS and SQL injection, along with comprehensive browser interaction capabilities for web application penetration testing.
Last updated -
12
1,346
17
JavaScript
MIT License
OSSInsight MCP Server
damonxue
A
security
A
license
A
quality
Provides GitHub data analysis for repositories, developers, and organizations, enabling insights into open source ecosystems through API calls and natural language queries.
Last updated -
5
13
JavaScript
MIT License
MCP Vulnerability Management System
nesirat
-
security
A
license
-
quality
A comprehensive system that helps organizations track, manage, and respond to security vulnerabilities effectively through features like vulnerability tracking, user management, support tickets, API key management, and SSL certificate management.
Last updated -
Python
MIT License
EPSS MCP Server
jgamblin
-
security
A
license
-
quality
A server that retrieves CVE details from the NVD API and fetches EPSS scores to provide comprehensive vulnerability information, including descriptions, CWEs, CVSS scores, and exploitation likelihood percentiles.
Last updated -
11
Python
MIT License

View all related MCP servers

Risky Business AI MCP Server

📹 Demo

Demo Workflow

Sample Alert Message (Sent via Beeper)

🛠️ Tools

search_github_repositories

get_cve_from_nist

search_kev

list_github_repository_files

get_github_file_content

📝 Prompts

cve_repository_search

advanced_cve_search_strategies

📊 Resources

kev://cisa/catalog

assets://company/inventory

🚀 Quick Start

Prerequisites

Installation

Running the Server

Claude Desktop Integration

Environment Variables

🤝 Contributing

📄 License

Related MCP Servers

MCP Server Pentest

OSSInsight MCP Server

MCP Vulnerability Management System

EPSS MCP Server

MCP directory API

`search_github_repositories`

`get_cve_from_nist`

`search_kev`

`list_github_repository_files`

`get_github_file_content`

`cve_repository_search`

`advanced_cve_search_strategies`

`kev://cisa/catalog`

`assets://company/inventory`