Skip to main content
Glama
MRFrazer25

vulnerability-exposure-mcp

by MRFrazer25
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to vulnerability-exposure-mcp

No user-submitted related servers found.

    Related Servers

    • CVEstate

      enabled404
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables vulnerability lookup and triage across NVD, EPSS, CISA KEV, OSV, and many other sources, while tracking an estate's exposure changes from SBOMs and lockfiles through snapshots and prioritized diffs.
      Apache 2.0

    • mcp-shodan

      Alessia8476
      F
      license
      Not graded
      quality
      A
      maintenance
      Enables AI agents to search internet-connected devices, perform IP and host reconnaissance with port, banner and TLS data, run DNS lookups, and retrieve CVE/CPE vulnerability intelligence including CVSS, EPSS and KEV status. It supports credit-aware queries with both stdio and HTTP streaming transports for clients like Claude Code, Codex, Gemini CLI and Claude Desktop.
      -

    • vuln-intel-mcp

      rohanrajnist
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
      1
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.9/5.0

    Scored across 16 tools

    Disambiguation4/5

    Descriptions actively steer selection: cve_search says it is not version-aware and to prefer version_specific_vulnerability_check, nvd_lookup says it is unnecessary for CVEs a version check already returned, and cisa_kev_check is scoped to 'once per product for its KEV history'. The remaining soft overlap is among the point-reputation tools (abuseipdb_check, virustotal_check, threat_lists_check) and the fact that investigate_target already runs several of them as a baseline, but each is a distinct data source and the overlap is explained.

    Naming Consistency4/5

    All snake_case, with a dominant <source>_<action> family (abuseipdb_check, shodan_search, virustotal_check, cve_search, nvd_lookup, cisa_kev_check, distro_patch_check, threat_lists_check) and a smaller verb_noun family (investigate_target, resolve_domain, get_key_facts, check_report). The deviations are 'ip_owner' and the bare noun 'subdomains', which are readable but break the pattern slightly.

    Tool Count4/5

    At 16 tools the surface sits at the upper edge, but each tool maps to a distinct data source or a distinct workflow step (baseline triage, version matching, distro backports, reporting sanity check), so nothing feels duplicative. It is on the heavier side for an agent to hold in context, which is the only reason it is not a 5.

    Completeness4/5

    Coverage of the vulnerability-exposure lifecycle is strong: target classification and baseline recon, DNS/subdomain discovery, IP ownership, multi-source reputation, version-aware CVE matching, distro backport patches, KEV/EPSS enrichment, and a self-verification step before reporting. Minor gaps: no way to list or resume prior investigations despite investigation-scoped tools, and no direct 'which CVEs affect this vendor/product' structured query beyond keyword cve_search.

    Maintenance

    ActivityNo data
    ResponsivenessNo issues

    Resources