Provides tools for querying Red Hat Security Data API, including searching CSAF advisories, retrieving full CSAF documents, searching CVEs, getting CVE details, listing OVAL streams, and obtaining OVAL stream data for products like RHEL9.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Red Hat Security Data API MCP Server What are the recent CVEs affecting RHEL 9?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that gives LLMs like Claude access to the Red Hat Security Data API. Query CSAF advisories, CVEs, and OVAL stream data through natural language.
This server exposes six tools that wrap the Red Hat Security Data API v1.0:
Tool | Description |
| Search CSAF advisory documents by date, severity, CVE, package, or RHSA ID |
| Get the full CSAF document for a specific advisory |
| Search CVEs by date, severity, CVSS score, CWE, package, or product |
| Get full CVE details including affected releases and mitigations |
| List available OVAL v2 stream files |
| Get OVAL stream data for a specific product (e.g. RHEL9) |
Related MCP server: Control-Inventory-MCP-Server
npm install
npm run build
npm startThe server runs over stdio using the MCP protocol. See the docs below for connecting it to Claude Desktop or other MCP clients.
Building and Running -- Build from source, container (Podman), and environment variables
Claude Desktop / Claude Code Setup -- Configuration for MCP clients
Tools Reference -- Parameters and descriptions for all six tools
src/
index.ts MCP server entry point and tool registration
api-client.ts HTTP client for the Red Hat Security Data API
tools/
csaf.ts search_csaf, get_csaf_details
cve.ts search_cves, get_cve_details
oval.ts list_oval_streams, get_oval_stream
Containerfile Multi-stage production build
build.sh Container image build script (Podman)
podman-compose.yml Local testing configuration (podman compose)See LICENSE.
Retrieve the full CSAF document for a specific Red Hat Security Advisory (RHSA) by its ID.
Inputs: rhsa_id (required).
Retrieve full details for a specific CVE including severity, CVSS scores, affected releases, package state, mitigations, and references.
Inputs: cve_id (required).
Retrieve OVAL stream data for a specific Red Hat product by base name (e.g. RHEL7, RHEL9).
Inputs: base (required).
List available Red Hat OVAL v2 stream files, optionally filtered by product label or modification date.
Inputs: after, label.
Search Red Hat CSAF advisory documents by date, severity, CVE, package, Bugzilla ID, or RHSA ID. Returns a paginated list of advisory summaries.
Inputs: bug, cve, page, after, +6 more.
Search Red Hat CVEs by date, severity, CVSSv3 score, CWE, package, product, advisory, or Bugzilla ID. Returns a paginated list of CVE summaries.
Inputs: bug, cwe, ids, page, +11 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 6 tools
Each tool targets a distinct resource type and action: CSAF search/detail, CVE search/detail, and OVAL list/retrieve. The resource nouns are explicit, so there is no meaningful overlap between search_csaf and search_cves or between the detail retrieval tools.
All tool names follow a clear verb_noun pattern with search_, get_, and list_ prefixes. The naming is consistent and predictable: search_* for queries, get_*_details/get_*_stream for fetching individual items, and list_* for enumerating available streams.
Six tools is well-scoped for a security data lookup server. The set covers three data types with paired search/list and detail retrieval operations, and every tool maps to a meaningful API action without redundancy or bloat.
The server provides both discovery/search and full-detail access for CSAF advisories, CVEs, and OVAL streams. As a read-only security data API, no create/update/delete operations are expected, and the retrieval lifecycle is effectively complete.
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Ask about your Kodem Security data and act on findings in plain language, with your permissions.
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
Query OneLens cloud-cost data in natural language: breakdowns, trends, cost centers. Read-only.