CVE Intelligence MCP

A lightweight, read-only Streamable HTTP MCP server for the official CVE List V5. It retrieves records on demand from the upstream repository and enriches them with the public CISA Known Exploited Vulnerabilities catalog.

Tools

• get_cve: CVE metadata, descriptions, affected products and versions, metrics, references, and KEV status.

• get_cves: batch lookup for up to 25 CVE IDs.

• get_required_action: affected products, official references, and CISA's required action when the CVE is in KEV.

Related MCP server: vuln-intel-mcp

Run locally

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
uvicorn server:app --host 127.0.0.1 --port 8000

Connect an MCP client using Streamable HTTP:

http://127.0.0.1:8000/mcp

Deploy to Render

Create a Render Blueprint from this repository. render.yaml contains the build and start commands. The deployed endpoint is:

https://<render-service-name>.onrender.com/mcp

Data and operational notes

• CVE data is fetched from the official CVEProject repository at request time.

• CISA KEV is cached in memory for one hour.

• The service is read-only and does not modify upstream data.

• Vendor advisories referenced by the CVE record remain the authoritative source for exact patch versions and mitigations.

• The Render free plan can spin down when idle, so the first request may be slow.

License

Server code is provided under the Apache-2.0 license. Upstream CVE records remain subject to the CVE Program terms of use and their record-level provenance.