CVE MCP Server

Ask “Should we patch CVE-2024-3400?” — get a scored, evidence-backed verdict in seconds.

Quick start · Demos · Tools · Scoring · Configuration · Architecture

Real output of cve-mcp call triage_cve — exactly the text your MCP client receives.

CVE MCP Server is a Model Context Protocol server that turns Claude (or any MCP client) into a security analyst. Instead of juggling NVD, EPSS, CISA KEV, GitHub, Exploit-DB, Shodan and VirusTotal in fifteen browser tabs, you ask one question — the server fans out to every relevant source in parallel, correlates the evidence and answers with a prioritised recommendation.

It ships as one self-contained Rust binary: no Python, no Node, no runtime to install.

✨ Highlights

🎯 One-call triage triage_cve queries NVD, EPSS, CISA KEV and public exploit sources concurrently and returns a verdict — with a VulnCheck fallback when NVD is down.

🧮 Evidence over severity A transparent 0–100 score weights exploitation (EPSS + KEV) above raw CVSS. KEV-listed CVEs are always CRITICAL. Optional SSVC decision.

🔍 29 tools · 23 sources CVE intel, exploits & PoCs, ATT&CK, vendor advisories, IP / domain / hash / URL reputation, ransomware wallets, known-good files.

📦 Dependency scanning Paste a requirements.txt, package.json, pom.xml or OS package list — get the most severe CVEs per package with real severities.

🦀 Fast & lean Single ~11 MB binary, async Tokio core, SQLite cache, starts instantly. Runs over stdio or stateless streamable HTTP.

🔐 Secure by default Outbound host allowlist on every request and redirect, masked secrets, redacted audit log, private-IP blocking, XXE-safe XML.

Related MCP server: CVE Intelligence MCP Server

🚀 Quick start

1 — Install (needs Rust 1.88+ and a C compiler)

cargo install --git https://github.com/Liohtml/cve-mcp-server --locked
cve-mcp --version

Prefer a download? Tagged releases ship prebuilt binaries for Linux, macOS and Windows on the Releases page.

2 — Connect your MCP client

# Claude Code
claude mcp add cve-mcp -e NVD_API_KEY=your-key -- cve-mcp

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "cve-mcp": {
      "command": "/absolute/path/to/cve-mcp",
      "env": {
        "NVD_API_KEY": "your-key",
        "GITHUB_TOKEN": "ghp_..."
      }
    }
  }
}

Use the absolute path (e.g. ~/.cargo/bin/cve-mcp, expanded) — Claude Desktop does not inherit your shell PATH. Fully quit and restart Claude Desktop afterwards.

Register a stdio server whose command is cve-mcp (no arguments), or point an HTTP-capable client at a running instance: http://localhost:8000/mcp (see Docker / HTTP). To poke at it interactively:

npx @modelcontextprotocol/inspector cve-mcp

3 — Ask

“Is CVE-2021-44228 actively exploited and how urgent is it?” “Scan this requirements.txt and tell me what to upgrade first.” “Compare CVE-2024-3400, CVE-2024-6387 and CVE-2023-38545 — what do we patch first?”

No API key is required to start. Adding a free NVD_API_KEY makes NVD lookups 10× faster.

🎬 See it in action

Every tool can also be run straight from the terminal with cve-mcp call <tool> key=value … — handy for scripting and CI. The recordings below are real output.

Scan dependencies — the five most severe vulnerabilities per package, with CVE aliases and severities computed from CVSS v2/v3/v4 vectors:

Prioritise a backlog — rank CVEs by composite risk to decide what gets patched first:

🧰 Tools

⭐ Start here

🛡️ Vulnerability intelligence

💥 Exploits, risk & reporting

🌐 Network & threat intelligence

🧑‍💻 DevSecOps

🧮 How the verdict is made

• Why these weights? EPSS is the best predictor of real-world exploitation, KEV is ground truth that exploitation happens, CVSS describes severity rather than likelihood (Allodi & Massacci, 2014), and a public PoC lowers the attacker's bar.

• KEV hard override: a CISA KEV listing means confirmed in-the-wild exploitation — the label is always CRITICAL and the score at least 76, whatever CVSS and EPSS say.

• PoC confidence ladder: WEAPONIZED 15 · PUBLIC_EXPLOIT_REMOTE 12 · PUBLIC_EXPLOIT 10 · PUBLIC_POC_HIGH_QUALITY 7 · PUBLIC_POC_LOW_QUALITY 3.

• SSVC (deep mode): the CISA Deployer decision tree (Exploitation × Automatable × Technical Impact × Mission & Well-being) yields Act, Attend, Track* or Track — an explainable, non-numeric second opinion.

🏗️ Architecture

src/
├── main.rs            CLI: serve (stdio / HTTP), call, --list-tools, --healthcheck
├── mcp/               JSON-RPC dispatcher · stdio transport · streamable-HTTP transport
├── tools/             tool registry + handlers (core, threat, vuln, devsecops, risk, triage)
├── api/               one client per upstream (NVD, EPSS, KEV, OSV, VulnCheck, …)
├── utils/             risk scorer · SSVC · CVSS v2/v3/v4 · fan-out · retry · source trust
├── http.rs            reqwest + rustls, host allowlist, redirect checks, size limits
├── cache.rs           SQLite cache (WAL, per-source TTLs)
├── audit.rs           rotating JSON audit log
├── config.rs          environment config, Secret type
├── validators.rs      CVE / IP / hash validation, SSRF checks
├── resources.rs       kev://catalog · epss://scores/{cve_id} · manifest://tool-hash
└── prompts.rs         patch_decision · compare_and_prioritize · dependency_triage

⚙️ Configuration

Configuration comes from environment variables; a .env file in the working directory is loaded automatically (see .env.example). Every key is optional — tools say which key they are missing.

🐳 Docker / HTTP

docker build -t cve-mcp-server .
docker run --rm -p 8000:8000 --env-file .env cve-mcp-server
claude mcp add --transport http cve-mcp http://localhost:8000/mcp

The HTTP transport is stateless (one JSON-RPC message per POST /mcp, JSON response) and accepts browser requests only from local origins unless MCP_ALLOWED_ORIGINS says otherwise. Put it behind your own TLS / auth proxy before exposing it beyond a trusted network.

⌨️ Command line

cve-mcp                                   # serve MCP (stdio, or HTTP with MCP_TRANSPORT=http)
cve-mcp call triage_cve cve_id=CVE-2024-3400 depth=deep
cve-mcp call scan_dependencies dependency_list=@requirements.txt   # @file / @- for stdin
cve-mcp call compare_cves '{"cve_ids": ["CVE-2024-3400", "CVE-2024-6387"]}'
cve-mcp --list-tools | --healthcheck | --version | --help

🔐 Security & privacy

• Outbound only, allowlisted: every request and every redirect hop must target a known API host; no inbound ports with stdio.

• No secrets in logs: keys live in a Secret type with masked output, error messages strip credentials from URLs, and the audit log redacts any parameter named *key* / *token*.

• Input hardening: CVE / IP / hash validation, private & reserved IP ranges blocked (including IPv4-mapped IPv6), size-limited response bodies, pom.xml parsed with DTDs disabled.

• No sampling: the server never sends sampling/createMessage back to the client — all model interaction is client-driven.

• Local data: responses are cached in a local SQLite file; nothing is sent anywhere except the lookups themselves.

Found a vulnerability? Please follow SECURITY.md.

🧪 Development

cargo build                       # debug build
cargo test                        # unit + integration tests (offline, no API keys)
cargo fmt --all --check && cargo clippy --all-targets -- -D warnings

CI runs the tests on Linux, macOS and Windows, checks the MSRV (1.88), audits dependencies and builds the Docker image. See CONTRIBUTING.md for how to add a tool.

The banner and diagrams in assets/ are hand-written SVG. The terminal GIFs are rendered from real recordings in scripts/readme-assets/recordings with headless Chromium (Playwright) and Pillow:

cve-mcp call triage_cve cve_id=CVE-2021-44228 depth=deep > scripts/readme-assets/recordings/triage.txt
node scripts/readme-assets/render-terminal.cjs triage    # also: scan, compare

• Client shows no tools — check the config JSON for trailing commas, use the absolute binary path, fully restart the client. RUST_LOG=debug cve-mcp prints diagnostics to stderr.

• “NVD rate limit exceeded” — set NVD_API_KEY; triage_cve also falls back to VulnCheck when VULNCHECK_TOKEN is set.

• MalwareBazaar / ThreatFox return nothing — abuse.ch requires ABUSECH_AUTH_KEY since 2025.

• GitHub-based searches are empty — unauthenticated GitHub search allows only a handful of requests per minute; set GITHUB_TOKEN. Rate-limited results are never cached, so a retry works once the limit resets.

• Corporate proxy / custom CA — HTTPS_PROXY / NO_PROXY are honoured and TLS uses the OS certificate store (plus SSL_CERT_FILE on Linux).

🙏 Credits & license

Originally created in Python by Mahipal Jangra (mukul975); this fork is a full Rust rewrite with the same tool surface. Licensed under the Apache License 2.0.