Skip to main content
Glama
Sign In
CVEstate

CVEstate

by enabled404
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Related Servers

Alternatives to CVEstate

No user-submitted related servers found.

    Related Servers

    • Aegis MCP

      ajaybe-ops
      A
      license
      A
      quality
      C
      maintenance
      Connects AI agents to structured vulnerability intelligence from NVD, EPSS, KEV, and OSV, enabling deterministic, policy-scored incident triage, CVE lookup, vulnerability search, and package scanning through auditable MCP tools.
      6
      1
      MIT

    • mcp-supply-chain-check

      MuellerMH
      A
      license
      A
      quality
      C
      maintenance
      Enables coding agents to check individual project dependencies or local CycloneDX/SPDX SBOM files against the public OSV.dev advisory database and receive ranked vulnerability findings.
      2
      MIT

    • CVE Search MCP Server

      Arnabdaz
      F
      license
      A
      quality
      D
      maintenance
      Enables searching and analyzing CVEs and vulnerabilities from multiple sources, optimized for PR review scenarios to help developers identify the latest security issues.
      8
      2
      -

    • CVE MCP Server

      AlessioMealli
      A
      license
      A
      quality
      C
      maintenance
      Enables Claude to look up known vulnerabilities in a project's dependencies across OSV.dev, CVE.org, NVD, CISA KEV and EPSS, then rank the findings by real-world exploitation so the most urgent fixes surface first. It supports single-package checks, keyword CVE searches, and whole-lockfile scans, with upgrade-path reasoning.
      4
      MIT

    • vuln-priority

      arhancanli
      A
      license
      A
      quality
      B
      maintenance
      Enables prioritizing vulnerabilities by real-world exploitation evidence, combining CISA KEV, EPSS, CVSS, and SSVC to rank CVEs and package versions, and providing fix recommendations.
      4
      2
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.2/5.0

    Scored across 32 tools

    Disambiguation3/5

    Several tools overlap substantially: get_cve_summary, lookup_cve, triage_cve, calculate_risk_score, and check_exploit_availability/check_poc_exists all retrieve or derive overlapping CVE intelligence. Descriptions help distinguish depth and orchestration level, but an agent still has multiple plausible choices for common tasks like 'tell me about this CVE' or 'find exploits'. Other areas, such as threat-intel lookups, are more clearly separated.

    Naming Consistency3/5

    Most names use snake_case, but the verb conventions are mixed: check_*, get_*, lookup_*, scan_*, search_*, calculate_*, generate_*, compare_*, triage_*, estate_*, watch_*, and health_check. This is still readable, but the set does not follow a single predictable verb_noun pattern. The estate_* and watch_* prefixes are internally consistent but differ from the rest.

    Tool Count2/5

    At 32 tools, the surface is heavy for a single MCP server and includes many overlapping CVE-enrichment and scanning entry points. While the security domain is broad, several tools could reasonably be consolidated or exposed as options on fewer tools. The count exceeds the typical well-scoped range and increases selection burden.

    Completeness4/5

    The server covers a strong CVE lifecycle: lookup, search, summary, triage, timeline, risk scoring, comparison, exploit discovery, advisories, EPSS, KEV, ATT&CK mapping, and estate scanning. Minor gaps exist around estate management, such as listing or removing watched packages and more explicit snapshot management, but core workflows are covered.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Resources