# ExploitDB MCP

An MCP server for searching Exploit-DB exploits and shellcodes.

## Requirements

- Node.js 20 or newer and npm.
- Network access only when downloading/updating the database.

## Install and build

```bash
git clone https://github.com/d4ngkh04w/ExploitDB-MCP.git
npm ci
npm run update-db
npm run build
```

## MCP client configuration

Configure a standard MCP client to start the built server using Node.js and the absolute path to this project:

```json
{
  "mcpServers": {
    "exploitdb": {
      "command": "node",
      "args": ["/absolute/path/to/exploitdb-mcp/dist/index.js"]
    }
  }
}
```

## Tools

- `search_exploits`: search exploits by text and optional platform, exploit type, author, and verified filters.
- `get_exploit`: get exploit metadata by EDB-ID. `include_code` defaults to `false`; when enabled, the raw source is bounded to at most 50,000 characters (default 12,000).
- `search_shellcodes`: search shellcodes by text and optional platform, author, and verified filters.
- `get_shellcode`: get shellcode metadata by EDB-ID, with the same opt-in bounded source preview behavior.
- `search_by_cve`: exact CVE search over exploits and shellcodes, optionally restricted to either collection.

## License

The ExploitDB MCP project code is licensed under the MIT License; see [LICENSE](LICENSE).

Exploit-DB metadata and exploit/shellcode source content are third-party material from
[Exploit-DB](https://gitlab.com/exploit-database/exploitdb) and remain subject to their
applicable copyright and license terms. The MIT License for this project code does not
relicense that upstream content.