The PatrowlIntelMCP server provides read-only access to PatrowlIntel's vulnerability intelligence, exposing three tools to any MCP-compatible client:
search_cves — Search and filter the CVE feed using criteria such as:
Free-text search on CVE ID or summary
Minimum Patrowl EASM risk score (min_score, 0–1)
Minimum EPSS exploit probability (min_epss, 0–1)
CISA KEV catalog entries only (is_kev)
CVEs with at least one public exploit (has_exploit)
Remotely exploitable CVEs (is_remote)
Vendor/product technology scope (e.g. Apache, Fortinet FortiOS)
Publication date range (published_from / published_to)
Sorting and pagination (up to 100 per request)
get_cve — Retrieve the full intelligence record for a single CVE, including CVSS scores/vectors, EPSS probability, CISA KEV status and dates, CISA SSVC decision, public exploit links, affected technologies/CPEs, weaknesses (CWEs), and references.
list_trending_attacks — List recently trending threats and actively discussed attacks, filterable by minimum severity (0=Info to 4=Critical) and publication date, sorted most-recent first (up to 100 per request).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PatrowlIntelMCP search for CVEs with public exploits"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that exposes PatrowlIntel vulnerability intelligence (CVEs, EPSS, CISA KEV, public exploits, trending attacks) to any MCP client. It is a thin, read-only stdio wrapper over the public PatrowlIntel API.
v0 — three tools:
search_cves,get_cve,list_trending_attacks.
Tool | Purpose |
| Filter/rank the CVE feed (risk score, EPSS, KEV, exploited, technology, dates). |
| Full record for one CVE (CVSS, EPSS, KEV, SSVC, exploits, references). |
| Recent trending threats, filterable by severity and date. |
Related MCP server: CVE-Search MCP Server
Variable | Default | Purpose |
|
| Backend API base URL. |
| = API base | Public site base used for CVE citation links. |
| (unset) | Reserved for the future authenticated tier. |
|
| Per-request timeout (seconds). |
|
|
|
|
| Bind host for |
|
| Bind port for |
# stdio (default) — for local MCP clients that launch the process
uv run patrowl-intel-mcp # or: pip install -e . && patrowl-intel-mcp
# streamable-http — as a networked service (e.g. Docker); serves at /mcp
PATROWL_INTEL_MCP_TRANSPORT=streamable-http PATROWL_INTEL_MCP_HOST=0.0.0.0 \
uv run patrowl-intel-mcp{
"mcpServers": {
"patrowl-intel": {
"command": "uvx",
"args": ["patrowl-intel-mcp"],
"env": { "PATROWL_INTEL_API_BASE": "https://<your-intel-host>" }
}
}
}During local development, point command at your checkout instead:
{ "command": "uv", "args": ["--directory", "/path/to/PatrowlIntelMCP", "run", "patrowl-intel-mcp"] }Fetch full intelligence for a single CVE: CVSS, EPSS, CISA KEV status and dates, CISA SSVC decision, public exploit links, affected technologies, weaknesses and references.
Inputs: cve_id (required), verbose.
List trending attacks / actively-discussed threats from the Patrowl feed, most recent first. Use min_severity=3 to focus on High and Critical.
Inputs: limit, since, min_severity.
Search the PatrowlIntel CVE feed with rich filters and return compact, ranked results. Use it to triage by risk (min_score / min_epss), surface KEV or exploited CVEs, or scope a vendor/technology. For the full record of one CVE, follow up with get_cve.
Inputs: sort, limit, query, is_kev, +7 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 3 tools
Each tool has a clearly distinct purpose: get_cve retrieves full details for a single CVE, list_trending_attacks shows trending threats, and search_cves provides filtered search. No ambiguity between them.
All tool names follow a consistent verb_noun snake_case pattern (get_cve, list_trending_attacks, search_cves), making them predictable and easy to understand.
Three tools is appropriate for a focused threat intelligence server. Each tool serves a distinct, essential function (detail retrieval, trending list, search) without being too few or too many.
The tool set covers the core needs: fetching CVE details, searching with filters, and viewing trending threats. Minor gaps exist, such as lacking a direct tool for bulk listing or subscription features, but the set is largely complete for typical use cases.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
Read-only vulnerability intelligence: CVEs, exploitation evidence, fixes and product matches.
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations.
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
