ExploitDB MCP

An MCP server for searching Exploit-DB exploits and shellcodes.

Requirements

• Node.js 24 LTS (recommended), or Node.js 26+, and npm. Node.js 20 is not supported by the current SQLite/test dependencies.

• Network access only when downloading/updating the database.

Related MCP server: Exploit-DB MCP Server

Install and build

git clone https://github.com/d4ngkh04w/exploitdb-mcp-server.git
cd exploitdb-mcp-server
npm install
npm run update-db
npm run build

The lockfile pins dependencies. Do not omit optional dependencies, which supply platform-specific binaries. No separate rebuild step is required.

MCP client configuration

Configure a standard MCP client to start the built server using Node.js and the absolute path to this project:

{
  "mcpServers": {
    "exploitdb": {
      "command": "node",
      "args": ["/absolute/path/to/exploitdb-mcp-server/dist/index.js"]
    }
  }
}

Tools

• search_exploits: search exploits by text and optional platform, exploit type, author, and verified filters.

• get_exploit: get exploit metadata by EDB-ID. include_code defaults to false; when enabled, the raw source is bounded to at most 50,000 characters (default 12,000).

• search_shellcodes: search shellcodes by text and optional platform, author, and verified filters.

• get_shellcode: get shellcode metadata by EDB-ID, with the same opt-in bounded source preview behavior.

• search_by_cve: exact CVE search over exploits and shellcodes, optionally restricted to either collection.

Documentation

• Usage, snapshot metadata, updates and troubleshooting

• Validation and CI

License

The ExploitDB MCP project code is licensed under the MIT License; see LICENSE.

Exploit-DB metadata and exploit/shellcode source content are third-party material from Exploit-DB and remain subject to their applicable copyright and license terms. The MIT License for this project code does not relicense that upstream content.