secintel-mcp

A Model Context Protocol server that gives AI agents the lookups a security analyst reaches for every day: how urgent is this CVE, is this dependency vulnerable, and what indicators are in this report.

It uses only free public data sources and needs no API keys.

You:    How worried should I be about CVE-2021-44228?
Agent:  → triage_cve("CVE-2021-44228")
        P1 — patch immediately. It is in CISA's Known Exploited Vulnerabilities
        catalogue with known ransomware use, CVSS 10.0, EPSS 0.94.

Tools

Triage policy

triage_cve puts evidence of exploitation ahead of raw severity:

The thresholds live in src/secintel_mcp/triage.py and are meant to be changed to match your own policy. The result is a starting point: it does not know whether the affected product is deployed or reachable in your environment. If one source is unavailable the tool still answers from the others and lists what failed in source_errors.

Related MCP server: cve-lookup-mcp

Install

Requires Python 3.11+.

git clone https://github.com/blonde-almond/secintel-mcp.git
cd secintel-mcp
python -m venv .venv && source .venv/bin/activate
pip install -e .

Use it

Claude Desktop, Claude Code, or any stdio MCP client

Add the server to your client's MCP configuration (for Claude Desktop this is claude_desktop_config.json; a copy is in examples/):

{
  "mcpServers": {
    "secintel": {
      "command": "/absolute/path/to/secintel-mcp/.venv/bin/secintel-mcp"
    }
  }
}

With Claude Code: claude mcp add secintel -- /absolute/path/to/.venv/bin/secintel-mcp

Over HTTP

secintel-mcp --transport streamable-http --port 8000
# MCP endpoint: http://127.0.0.1:8000/mcp

The HTTP transport binds to loopback by default and has no authentication. To reach it from another machine, put it behind a reverse proxy that handles TLS and authentication rather than binding it to a public interface.

Configuration

Security design

An MCP server is code that a language model can drive, so its inputs should be treated as untrusted. This one is built accordingly:

• No server-side request forgery. Every outbound request goes to one of four hard-coded hosts. Tool arguments are only ever sent as validated query parameters or JSON fields, never used to build a URL, and redirects are not followed.

• Strict input validation. CVE IDs, ecosystems, package names and versions are checked against allow-list patterns before any request is made.

• Bounded work. Requests have timeouts, responses have a size cap, text inputs have a length cap, and result lists are truncated.

• Minimal untrusted text. Upstream records are trimmed to the needed fields and descriptions are length-limited, and the server instructions tell the agent to treat returned text as data. This reduces, but cannot eliminate, the risk of prompt injection through vulnerability descriptions.

• Read-only. No tool writes files, runs commands or changes any system.

• No secrets required. The optional NVD key is read from the environment and sent only to the NVD.

See SECURITY.md to report a vulnerability.

Development

pip install -e ".[dev]"
pytest          # all tests run offline against a fake upstream
ruff check .
ruff format .

src/secintel_mcp/
  server.py    MCP tool definitions and the command-line entry point
  clients.py   NVD, EPSS, KEV and OSV clients, validation, caching
  triage.py    The P1–P4 prioritisation policy
  iocs.py      Indicator extraction, defang and refang

Limitations

• IPv6 addresses are not extracted.

• Domain extraction is pattern-based. It skips common file extensions (setup.exe, archive.zip) but will sometimes match things that are not indicators, and it does not check that a TLD exists.

• Caches are in memory and per process: 15 minutes for CVE and EPSS lookups, 6 hours for the KEV catalogue.

• Without an NVD API key, heavy use will hit the NVD rate limit.

Licence

MIT