Security Intel MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cve_lookupA | Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS. |
| known_exploitedA | Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily. |
| epss_scoreA | Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS. |
| package_vulnerabilitiesA | List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex. |
| audit_dependenciesA | Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
The five tools mostly target distinct resources: individual CVE lookup, KEV catalog queries, EPSS scoring, per-package OSV lookup, and manifest-wide auditing. However, cve_lookup already bundles KEV and EPSS results inline, so an agent may be unsure when to call the dedicated known_exploited or epss_score tools versus the composite lookup. The package_vulnerabilities vs audit_dependencies split is clear (single package vs whole manifest).
Names are readable but follow mixed conventions: cve_lookup, known_exploited, epss_score, package_vulnerabilities, and audit_dependencies blend noun_noun, adjective-style, and verb_noun forms. Two tools (audit_dependencies, package_vulnerabilities) use verb-based action naming while others are noun phrases. Not chaotic, but no single predictable pattern.
Five tools is a tight, well-scoped surface for a security-intelligence server covering CVE data, exploit likelihood, and dependency auditing. Each tool earns its place without redundancy or thinness. No unused or filler tools.
The surface covers the core workflows: CVE detail, known-exploited status, EPSS prioritization, package lookup, and full manifest auditing. Minor gaps exist, such as keyword/vendor-based CVE search or advisory text search, but agents can work around these via CVE IDs and OSV queries.