cve-mcp

Traditional workflow:
  search NVD for CVE details          →  navigate a clunky web UI
  check EPSS for exploitation risk    →  separate API, separate format
  look up CISA KEV status             →  download a JSON feed manually
  search GitHub advisories            →  yet another interface
  query OSV for package impact        →  different API, different schema
  check Shodan for exposure           →  separate subscription
  look for Nuclei/MSF exploits        →  manual GitHub search
  map to ATT&CK techniques            →  separate MITRE lookup
  correlate everything                →  copy-paste into a spreadsheet
  ──────────────────────────────────
  Total: 30+ minutes per CVE, longer for bulk triage

With cve-mcp:
  You: "Prioritize these 10 CVEs by actual exploitation risk"

  Agent: → fetches CVSS scores from NVD
         → gets EPSS exploitation probability for each
         → checks CISA KEV for actively exploited
         → cross-references GitHub advisories for patches
         → "3 are critical: CVE-2024-3400 (EPSS 97%, in KEV),
            CVE-2023-44487 (HTTP/2 rapid reset, EPSS 96%),
            CVE-2021-44228 (Log4Shell, EPSS 97%, in KEV).
            Here are patches and affected versions..."

npx cve-mcp

git clone https://github.com/badchars/cve-mcp.git
cd cve-mcp
bun install

# Increases NVD rate limit from 5 to 50 requests per 30 seconds
export NVD_API_KEY=your-nvd-api-key

# Enables GitHub Advisory search (60 → 5000 requests/hour)
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# VulnCheck extended KEV, CPE, PURL search
export VULNCHECK_API_KEY=your-vulncheck-key

# Vulners vulnerability search across 200+ sources
export VULNERS_API_KEY=your-vulners-key

# AttackerKB community assessments
export ATTACKERKB_API_KEY=your-attackerkb-key

# With npx
claude mcp add cve-mcp -- npx cve-mcp

# With local clone
claude mcp add cve-mcp -- bun run /path/to/cve-mcp/src/index.ts

{
  "mcpServers": {
    "cve-mcp": {
      "command": "npx",
      "args": ["cve-mcp"],
      "env": {
        "NVD_API_KEY": "optional-key",
        "GITHUB_TOKEN": "optional-token",
        "VULNCHECK_API_KEY": "optional-key",
        "VULNERS_API_KEY": "optional-key",
        "ATTACKERKB_API_KEY": "optional-key"
      }
    }
  }
}

You: "What do you know about CVE-2024-3400?"

You: "We got hit by CVE-2024-3400. Give me everything."

Agent: → cve_enrich {cveId: "CVE-2024-3400"}
       → NVD: PAN-OS command injection, CVSS 10.0
       → EPSS: 97.2% exploitation probability
       → KEV: Added 2024-04-12, due 2024-05-01
       → Shodan: 4 CPEs, internet-exposed
       → Nuclei: Detection template exists (critical)
       → Metasploit: Exploit module available (excellent rank)
       → "Critical. Weaponized — both Nuclei and MSF modules exist.
          PAN-OS GlobalProtect, versions < 10.2.9-h1.
          Patch immediately. CISA deadline: May 1."

You: "Prioritize these CVEs from our scan: CVE-2021-44228, CVE-2024-3400,
      CVE-2023-44487, CVE-2024-21762, CVE-2023-4966"

Agent: → cve_prioritize {cves: [...]}
       → Ranks by CVSS × EPSS × KEV multiplier
       → "#1: CVE-2024-3400 (risk: 19.44, CVSS 10.0, EPSS 97%, KEV)
          #2: CVE-2021-44228 (risk: 19.40, CVSS 10.0, EPSS 97%, KEV)
          #3: CVE-2023-4966 (risk: 19.10, CVSS 9.4, EPSS 97%, KEV)
          All 5 are in CISA KEV — patch all immediately."

You: "Check if lodash 4.17.20 and django 3.2.0 have known vulnerabilities"

Agent: → osv_batch {queries: [
          {package: "lodash", version: "4.17.20", ecosystem: "npm"},
          {package: "django", version: "3.2.0", ecosystem: "PyPI"}
       ]}
       → "lodash 4.17.20: 3 vulnerabilities (prototype pollution)
          django 3.2.0: 12 vulnerabilities (SQL injection, XSS)
          Upgrade lodash to 4.17.21+, django to 4.2+"

You: "What are the most likely to be exploited CVEs right now?"

Agent: → cve_trending {limit: 10, minEpss: 0.9}
       → "Top 10 by exploitation probability:
          1. CVE-2024-3400 — PAN-OS (EPSS 97.2%, CVSS 10.0, KEV)
          2. CVE-2023-44487 — HTTP/2 Rapid Reset (EPSS 96.5%, CVSS 7.5, KEV)
          ..."

You: "Break down this CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"

Agent: → cvss_parse {vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}
       → "CVSS v4.0 — Score: 9.3 (CRITICAL)
          Network attack, low complexity, no attack requirements.
          No privileges, no user interaction.
          Vulnerable system: full C/I/A impact.
          Subsequent systems: no impact."

You: "Map CVE-2024-3400 to MITRE ATT&CK techniques"

Agent: → cve_to_attack {cweIds: ["CWE-77"]}
       → "CWE-77 (Command Injection) maps to:
          T1059 — Command and Scripting Interpreter (Execution)
          T1190 — Exploit Public-Facing Application (Initial Access)"

Risk Score = CVSS Base Score × EPSS Score × KEV Multiplier × Exploit Multiplier

Where:
  CVSS Base Score     = 0-10 (severity from NVD)
  EPSS Score          = 0-1 (exploitation probability from FIRST)
  KEV Multiplier      = 2 if in CISA KEV, 1 otherwise
  Exploit Multiplier  = 1.5 if Nuclei template OR Metasploit module exists, 1 otherwise

src/
├── index.ts                    Entry point + MCP stdio
├── types/
│   └── index.ts                ToolDef, ToolContext, ToolResult, API types
├── protocol/
│   ├── tools.ts                41 tool definitions (Zod schemas)
│   └── mcp-server.ts           MCP server + stdio transport
├── nvd/
│   ├── index.ts                NVD API v2 — search, get, recent
│   └── cpe.ts                  Product/CPE search
├── epss/
│   └── index.ts                EPSS — score, top
├── kev/
│   └── index.ts                KEV — check, search, recent (cached)
├── ghsa/
│   └── index.ts                GitHub Advisory — search, get
├── osv/
│   └── index.ts                OSV — query, get, batch
├── exploit/
│   └── index.ts                PoC search via GitHub repos
├── shodan/
│   └── index.ts                Shodan CVEDB + InternetDB (zero-auth)
├── vulncheck/
│   └── index.ts                VulnCheck KEV, CPE, PURL
├── vulners/
│   └── index.ts                Vulners search + lookup
├── nuclei/
│   └── index.ts                Nuclei template existence check
├── metasploit/
│   └── index.ts                MSF module check (cached metadata)
├── cpe/
│   └── index.ts                NVD CPE dictionary API
├── circl/
│   └── index.ts                CIRCL CVE enrichment
├── attackerkb/
│   └── index.ts                AttackerKB assessments
├── attack/
│   └── index.ts                CWE → MITRE ATT&CK mapping
├── cwe/
│   └── index.ts                CWE API (MITRE) + static fallback
├── cvss/
│   └── index.ts                CVSS v3.1 + v4.0 parser + calculator
├── meta/
│   ├── enrich.ts               Full CVE enrichment (8 sources parallel)
│   ├── prioritize.ts           Risk-based CVE ranking
│   ├── trending.ts             Trending CVEs by EPSS
│   ├── compare.ts              Side-by-side CVE comparison
│   └── sources.ts              11 source health checks
└── utils/
    ├── rate-limiter.ts          Queue-based rate limiter
    └── cache.ts                 TTL cache