Skip to main content
Glama
devsecforge

security-intel-mcp

by devsecforge
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python

🛰️ security-intel-mcp

A Model Context Protocol (MCP) server that gives Claude real vulnerability intelligence — CVE lookup (NVD), EPSS exploit-probability, and CISA KEV status — from free public APIs. No API key required.

MCP Python License: MIT

📖 What this is

When triaging a vulnerability, three questions matter: what is it, how likely is it to be exploited, and is it already being exploited in the wild? This MCP server answers all three from authoritative free sources, so an AI assistant can prioritize CVEs by real-world risk — not CVSS alone.

Related MCP server: cve-lookup-mcp

🧰 Tools

Tool

Source

Returns

cve_lookup(cve_id)

NVD

Description, publish date, CVSS severity

epss_score(cve_id)

FIRST EPSS

Probability of exploitation (next 30 days) + percentile

kev_check(cve_id)

CISA KEV

Whether it's known-exploited, with due date & required action

cve_enrich(cve_id)

all three

One combined, prioritized risk view

cve_enrich applies a transparent rule: KEV > high EPSS > high CVSS — the same logic a good vulnerability-management program uses.

⚙️ Install

git clone https://github.com/devsecforge/security-intel-mcp.git
cd security-intel-mcp
pip install -r requirements.txt

▶️ Use with Claude Desktop

Add to your claude_desktop_config.json (see examples/):

{
  "mcpServers": {
    "security-intel": {
      "command": "python",
      "args": ["/absolute/path/to/security-intel-mcp/server.py"]
    }
  }
}

Restart Claude Desktop, then ask: "Enrich CVE-2021-44228 and tell me if I should patch it now." Claude will call cve_enrich and answer with NVD, EPSS, and KEV data.

🧪 Run standalone

python server.py    # starts the MCP server over stdio

🔒 Notes

  • Uses public, unauthenticated endpoints; be mindful of NVD rate limits for bulk use.

  • Read-only intelligence — the server takes no actions and stores nothing.

🤝 Contributing & License

See CONTRIBUTING.md. MIT © 2026 devsecforge (S. Naz). Original work.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • cve-lookup-mcp

    Aashish-32
    A
    license
    A
    quality
    D
    maintenance
    Provides live CVE data from NVD and EPSS without API key, enabling AI assistants to look up CVSS scores, search vulnerabilities, and check product CVEs.
    3
    MIT

  • vuln-intel-mcp

    rohanrajnist
    A
    license
    Not graded
    quality
    C
    maintenance
    Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
    1
    MIT

  • security-intel-mcp

    nazsam
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to look up CVE details, EPSS exploit probability, and CISA KEV status from free public APIs to prioritize vulnerabilities by real-world risk. Combines these sources into a single enriched, prioritized view using a KEV > EPSS > CVSS rule.
    MIT