Skip to main content
Glama
firetix

MCP Vulnerability Checker Server

by firetix
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

MCP Vulnerability Checker Server

A modular Model Context Protocol (MCP) server providing comprehensive security vulnerability intelligence tools including CVE lookup, EPSS scoring, CVSS calculation, exploit detection, and Python package vulnerability checking.

Demo

Related MCP server: Socket MCP Server

🔗 Using the Hosted Server

The vulnerability intelligence MCP server is already hosted and ready to use! Simply configure your MCP client to connect to it.

Claude Desktop Configuration

Add this configuration to your Claude Desktop settings file (~/.config/claude/claude_desktop_config.json):

{
  "mcpServers": {
    "vulnerability-intelligence": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": {
        "FETCH_URL": "https://vulnerability-intelligence-mcp-server-edb8b15494e8.herokuapp.com/sse"
      }
    }
  }
}

Cursor IDE Configuration

Add this configuration to your Cursor MCP settings file (~/.cursor/mcp.json):

{
  "mcpServers": {
    "vulnerability-intelligence": {
      "url": "https://vulnerability-intelligence-mcp-server-edb8b15494e8.herokuapp.com/sse"
    }
  }
}

Alternatively, in Cursor IDE:

  1. Open Cursor Settings → Features → MCP Servers

  2. Click "Add New Server"

  3. Select "Server-Sent Events (SSE)" as the type

  4. Enter URL: https://vulnerability-intelligence-mcp-server-edb8b15494e8.herokuapp.com/sse

  5. Give it a name: vulnerability-intelligence

Test the Connection

Once configured, try these example queries in Claude or Cursor:

  • CVE Lookup: "Look up CVE-2021-44228" (Log4Shell vulnerability)

  • EPSS Score: "Get EPSS score for CVE-2021-44228"

  • Package Check: "Check the 'requests' Python package for vulnerabilities"

  • Exploit Check: "Check for exploits for CVE-2021-44228"

  • CVSS Calculator: "Calculate CVSS score for vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

🛡️ Available Security Tools

🔍 CVE Vulnerability Lookup (cve_lookup)

  • Purpose: Fetches detailed vulnerability information from the National Vulnerability Database (NVD)

  • Data Source: NIST National Vulnerability Database API 2.0

  • Usage: cve_lookup cve_id="CVE-2021-44228"

  • Features:

    • CVSS scores (v2.0, v3.0, v3.1) with severity ratings

    • Comprehensive vulnerability descriptions

    • References, advisories, and remediation links

    • CWE (Common Weakness Enumeration) mappings

    • Publication and modification timeline

    • Affected product configurations

📊 EPSS Score Lookup (get_epss_score)

  • Purpose: Get Exploit Prediction Scoring System (EPSS) scores for CVEs

  • Data Source: FIRST EPSS API

  • Usage: get_epss_score cve_id="CVE-2021-44228"

  • Features:

    • Probability of exploitation within 30 days

    • AI-powered risk prioritization

    • Real-time threat intelligence integration

    • Percentile rankings for relative risk assessment

🧮 CVSS Score Calculator (calculate_cvss_score)

  • Purpose: Calculate CVSS base scores from vector strings

  • Data Source: CVSS v3.0/v3.1 specification

  • Usage: calculate_cvss_score vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

  • Features:

    • Support for CVSS v3.0 and v3.1

    • Detailed metric breakdown

    • Severity level mapping (Critical, High, Medium, Low)

    • Vector string validation and parsing

🔎 Vulnerability Search (search_vulnerabilities)

  • Purpose: Search vulnerability databases with advanced filtering

  • Data Source: Multiple vulnerability databases (NVD, CVE)

  • Usage: search_vulnerabilities keywords="apache" severity="HIGH" date_range="1y"

  • Features:

    • Keyword-based search across vulnerability descriptions

    • Severity filtering (CRITICAL, HIGH, MEDIUM, LOW)

    • Date range filtering (30d, 90d, 1y, 2y, or custom)

    • Advanced query capabilities for threat research

🎯 Exploit Availability Check (get_exploit_availability)

  • Purpose: Check for public exploits and proof-of-concepts (PoCs)

  • Data Source: ExploitDB, Metasploit, GitHub, security advisories

  • Usage: get_exploit_availability cve_id="CVE-2021-44228"

  • Features:

    • Multi-source exploit detection

    • Active exploitation indicators

    • PoC code availability assessment

    • Threat intelligence aggregation

⏰ Vulnerability Timeline (get_vulnerability_timeline)

  • Purpose: Get comprehensive timeline and patch status information

  • Data Source: NVD, vendor advisories, security bulletins

  • Usage: get_vulnerability_timeline cve_id="CVE-2021-44228"

  • Features:

    • Publication and disclosure timeline

    • Patch availability status

    • Vendor advisory tracking

    • Remediation guidance timeline

🎯 VEX Status Check (get_vex_status)

  • Purpose: Check Vulnerability Exploitability eXchange (VEX) status for specific products

  • Data Source: Vendor VEX statements and product security advisories

  • Usage: get_vex_status cve_id="CVE-2021-44228" product="Apache HTTP Server"

  • Features:

    • Product-specific impact assessment

    • Vendor-provided exploitability statements

    • False positive filtering

    • Supply chain impact analysis

📦 Python Package Vulnerability Check (package_vulnerability_check)

  • Purpose: Checks Python packages for known security vulnerabilities

  • Data Source: OSV (Open Source Vulnerabilities) Database + PyPI

  • Usage: package_vulnerability_check package_name="requests" version="2.25.1"

  • Features:

    • Comprehensive vulnerability scanning for PyPI packages

    • Version-specific or all-versions checking

    • Detailed vulnerability reports with severity scores

    • Affected version ranges and fix information

    • Integration with CVE, GHSA, and PYSEC databases

    • Package metadata from PyPI

🏗️ Modular Architecture

The server is built with a clean, modular architecture:

mcp_simple_tool/
├── server.py                    # Main MCP server orchestration
└── tools/                       # Individual tool modules
    ├── cve_lookup.py            # CVE vulnerability lookup
    ├── epss_lookup.py           # EPSS score lookup
    ├── cvss_calculator.py       # CVSS score calculator
    ├── vulnerability_search.py  # Advanced vulnerability search
    ├── exploit_availability.py  # Exploit and PoC detection
    ├── vulnerability_timeline.py # Timeline and patch status
    ├── vex_status.py            # VEX status checking
    └── package_vulnerability.py # Python package security check

tests/                           # Comprehensive test suite
├── run_tests.py                 # Automated test runner
└── test_*.py                    # Individual tool tests

🔧 Alternative Setup Methods

Docker Setup (Recommended for Local Development)

  1. Initial setup:

# Clone the repository
git clone https://github.com/firetix/vulnerability-intelligence-mcp-server
cd vulnerability-intelligence-mcp-server

# Create environment file
cp .env.example .env

  1. Build and run using Docker Compose:

# Build and start the server
docker compose up --build -d

# View logs
docker compose logs -f

# Check server status
docker compose ps

# Stop the server
docker compose down

  1. The server will be available at: http://localhost:8000/sse

  2. Connect to Cursor IDE:

    • Open Cursor Settings → Features

    • Add new MCP server

    • Type: Select "sse"

    • URL: Enter http://localhost:8000/sse

Local Development Setup

  1. Install the uv package manager:

# Install uv on macOS
brew install uv
# Or install via pip (any OS)
pip install uv

  1. Install dependencies and run:

# Install the package with development dependencies
uv pip install -e ".[dev]"

# Using stdio transport (default)
uv run mcp-simple-tool

# Using SSE transport on custom port
uv run mcp-simple-tool --transport sse --port 8000

# Run the comprehensive test suite
python tests/run_tests.py

  1. For Cursor IDE integration (stdio mode):

    • Copy the absolute path to cursor-run-mcp-server.sh

    • Open Cursor Settings → Features → MCP Servers

    • Add new server with "stdio" type and the script path

🧪 Testing the Tools

Run the comprehensive test suite:

# Run all tests
python tests/run_tests.py

# Run individual tool tests
python tests/test_cve_lookup.py
python tests/test_package_vulnerability.py  
python tests/test_modular_server.py

Example Test Outputs

CVE Lookup Test:

🔍 **CVE Vulnerability Report: CVE-2021-44228**

📅 **Timeline:**
   • Published: 2021-12-10T10:15:09.143
   • Last Modified: 2023-11-07T04:10:58.217

⚠️ **CVSS Scores:**
   • CVSS 3.1: 10.0 (CRITICAL)

Package Vulnerability Test:

🚨 **Python Package Security Report: requests**

⚠️ **Found 11 known vulnerabilities**

📦 **Package Information:**
   • Latest Version: 2.32.3
   • Summary: Python HTTP for Humans.

🌍 Environment Variables

Available environment variables (can be set in .env):

  • MCP_SERVER_PORT (default: 8000) - Port to run the server on

  • MCP_SERVER_HOST (default: 0.0.0.0) - Host to bind the server to

  • DEBUG (default: false) - Enable debug mode

  • MCP_USER_AGENT - Custom User-Agent for HTTP requests

🚀 Deploy Your Own Instance

If you want to deploy your own instance of the vulnerability intelligence server, you can use Heroku for quick deployment:

Quick Deploy to Heroku

  1. Click "Deploy to Heroku" button

    Deploy to Heroku

  2. After deployment, your instance will be available at:

    • https://<your-app-name>.herokuapp.com/sse

  3. Configure your MCP client to use your deployed instance:

    • For Claude Desktop: Update the FETCH_URL in your configuration

    • For Cursor IDE: Update the URL in your MCP settings

  4. Test your deployment with the same example queries:

    • CVE Lookup: "Look up CVE-2021-44228"

    • EPSS Score: "Get EPSS score for CVE-2021-44228"

    • Package Check: "Check the 'requests' Python package for vulnerabilities"

    • Exploit Check: "Check for exploits for CVE-2021-44228"

📊 Data Sources & APIs

🤝 Security Use Cases

This MCP server is designed for security engineers, developers, and teams who need:

Vulnerability Research & Intelligence

  • Quick CVE lookups with comprehensive details

  • CVSS and EPSS scoring for accurate risk assessment

  • Advanced vulnerability search across multiple databases

  • Exploit availability and threat intelligence gathering

  • Timeline analysis for understanding vulnerability lifecycle

Risk Assessment & Prioritization

  • EPSS-based exploitation probability scoring

  • CVSS vector calculation and validation

  • VEX status checking for product-specific impact

  • Multi-factor risk analysis combining multiple data sources

Dependency Management

  • Python package security auditing

  • Version-specific vulnerability checking

  • Supply chain security assessment

  • Open source component risk evaluation

Security Operations & Incident Response

  • Rapid vulnerability triage and classification

  • Exploit availability assessment for threat modeling

  • Security advisory research and correlation

  • Timeline-based patch management planning

🔄 Extending the Server

The modular architecture makes it easy to add new security tools:

  1. Create a new module in mcp_simple_tool/tools/

  2. Export the function in tools/__init__.py

  3. Register the tool in server.py

  4. Add tests in tests/

See README_MODULAR.md for detailed extension guide.

📄 License

MIT License - see LICENSE file for details.

Available Tools

8 tools
calculate_cvss_scoreB

Calculate CVSS base score from vector string

ParametersJSON Schema
NameRequiredDescriptionDefault
vectorYesCalculate CVSS (Common Vulnerability Scoring System) base scores from vector strings to assess vulnerability severity. Provide a CVSS vector string in the format CVSS:x.x/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Supports CVSS v3.0 and v3.1 with detailed metric breakdown and severity level mapping.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only states the basic function without disclosing behavioral traits. It doesn't mention error handling for invalid vectors, rate limits, authentication needs, or what happens with unsupported CVSS versions. For a calculation tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves beyond the core calculation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without any wasted words. It's appropriately sized for a simple calculation tool and front-loaded with the core functionality, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (single parameter calculation) with rich schema coverage but no output schema or annotations, the description is minimally adequate. It states what the tool does but doesn't explain return values, error cases, or integration context with sibling tools, leaving room for improvement in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the parameter 'vector' fully documented in the schema including format examples and version support. The description adds no additional parameter semantics beyond what the schema already provides, so it meets the baseline of 3 where the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'calculate' and the resource 'CVSS base score from vector string', making the purpose immediately understandable. It distinguishes from siblings like 'get_epss_score' or 'cve_lookup' by focusing on score calculation rather than data retrieval. However, it doesn't specify the exact output format or differentiate from potential similar tools not in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'get_epss_score' for exploit prediction or 'search_vulnerabilities' for broader vulnerability data. It mentions CVSS versions (v3.0 and v3.1) in the schema but not in the description itself, leaving usage context implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cve_lookupC

Lookup CVE vulnerability information from the National Vulnerability Database

ParametersJSON Schema
NameRequiredDescriptionDefault
cve_idYesLookup detailed information about a CVE (Common Vulnerabilities and Exposures) from the National Vulnerability Database. Provide a CVE ID in the format CVE-YYYY-NNNN (e.g., CVE-2021-44228 for Log4Shell). Returns comprehensive vulnerability details including CVSS scores, descriptions, references, and associated weaknesses to help engineers understand security implications.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the data source (National Vulnerability Database) but doesn't cover critical aspects like rate limits, authentication requirements, error handling, or response format. This leaves significant gaps for an AI agent to understand operational constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's function without unnecessary words. It's front-loaded with the core purpose, making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what the tool returns (e.g., CVSS scores, descriptions) or behavioral traits like rate limits. For a lookup tool with no structured safety or output information, this leaves the AI agent under-informed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, with the parameter 'cve_id' fully documented in the input schema. The description adds no additional parameter semantics beyond what's already in the schema, so it meets the baseline for adequate but unremarkable coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Lookup') and resource ('CVE vulnerability information from the National Vulnerability Database'), making the tool's purpose immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'search_vulnerabilities' or 'package_vulnerability_check', which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'search_vulnerabilities' or 'get_vulnerability_timeline'. It lacks context about prerequisites, such as needing a specific CVE ID format, or exclusions, like not being suitable for batch queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_epss_scoreA

Get EPSS exploitability prediction score for a CVE

ParametersJSON Schema
NameRequiredDescriptionDefault
cve_idYesGet Exploit Prediction Scoring System (EPSS) scores for a CVE to assess the probability of exploitation in the wild within 30 days. Provide a CVE ID in the format CVE-YYYY-NNNN (e.g., CVE-2021-44228). Returns AI-powered risk prioritization scores with percentile rankings to help security teams focus on vulnerabilities most likely to be exploited by attackers.

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions the tool returns 'AI-powered risk prioritization scores with percentile rankings', which adds some behavioral context, but it does not disclose other traits like rate limits, authentication needs, or error handling. The description is minimal and lacks comprehensive behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded and every part of the sentence contributes to understanding the tool's function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter with full schema coverage and no output schema, the description is adequate but minimal. It explains what the tool does but lacks details on output format, error cases, or integration with sibling tools. For a simple lookup tool, it meets basic needs but could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the 'cve_id' parameter thoroughly. The description does not add any parameter-specific semantics beyond what the schema provides, such as format details or examples. Baseline score of 3 is appropriate as the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Get EPSS exploitability prediction score') and the resource ('for a CVE'), distinguishing it from sibling tools like 'calculate_cvss_score' or 'get_exploit_availability' by focusing on EPSS scores rather than CVSS or exploit availability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for assessing exploitation probability, but it does not explicitly state when to use this tool versus alternatives like 'calculate_cvss_score' or 'get_exploit_availability'. It provides some context (e.g., 'to assess the probability of exploitation') but lacks clear exclusions or named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_exploit_availabilityA

Check for public exploits and PoCs for a CVE

ParametersJSON Schema
NameRequiredDescriptionDefault
cve_idYesCheck for public exploits and proof-of-concepts (PoCs) for a CVE across multiple sources including ExploitDB, Metasploit, GitHub, and NVD references. Provide a CVE ID in the format CVE-YYYY-NNNN (e.g., CVE-2021-44228). Returns threat intelligence about exploit availability, active exploitation indicators, and weaponization status to assess immediate risk.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds context by listing sources (ExploitDB, Metasploit, GitHub, NVD) and return types (threat intelligence, exploitation indicators, weaponization status), but doesn't cover aspects like rate limits, authentication needs, or potential errors. It doesn't contradict annotations, as none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('Check for public exploits and PoCs for a CVE') with no wasted words. Every part of the sentence contributes essential information, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (threat intelligence query), no annotations, and no output schema, the description is moderately complete. It covers purpose, sources, and return types, but lacks details on output format, error handling, or integration with sibling tools, leaving some gaps for an agent to infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already fully documents the 'cve_id' parameter with format details and purpose. The description adds no additional parameter semantics beyond what's in the schema, meeting the baseline score of 3 for high coverage without extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('check for public exploits and PoCs') and resources ('for a CVE'), distinguishing it from siblings like 'cve_lookup' (general info) or 'get_epss_score' (exploit prediction). It precisely defines what the tool does without being vague or tautological.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by specifying 'check for public exploits and PoCs for a CVE,' suggesting it's for threat intelligence and risk assessment. However, it lacks explicit guidance on when to use this tool versus alternatives like 'search_vulnerabilities' or 'get_vex_status,' which could help differentiate further.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_vex_statusC

Check VEX vulnerability status for specific products

ParametersJSON Schema
NameRequiredDescriptionDefault
cve_idYesCheck Vulnerability Exploitability eXchange (VEX) status for specific products to determine actual impact and exploitability. Provide a CVE ID in format CVE-YYYY-NNNN and optionally a product name (e.g., 'Windows 11', 'RHEL 8', 'Apache HTTP Server'). Returns vendor-provided exploitability statements, false positive filtering, and product-specific impact assessment.
productNoProduct name or identifier to check VEX status for (optional). Examples: 'Windows 11', 'RHEL 8', 'Ubuntu 22.04', 'Apache HTTP Server'

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure but offers minimal information. It states what the tool does but doesn't describe response format, error conditions, rate limits, authentication requirements, or whether this is a read-only operation. For a tool with no annotation coverage, this leaves significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at just 8 words, front-loading the core purpose without unnecessary elaboration. Every word earns its place - 'Check' (verb), 'VEX vulnerability status' (what), 'for specific products' (scope). There's zero waste or redundancy in this single-sentence description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and 2 parameters, the description is insufficiently complete. It doesn't explain what VEX status entails, what format the response takes, whether this queries external databases, or what distinguishes VEX from other vulnerability assessments. Given the technical nature of vulnerability management and the lack of structured metadata, the description should provide more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents both parameters. The description doesn't add any parameter semantics beyond what's in the schema - it mentions CVE ID and product name but provides no additional context about format requirements, validation rules, or usage patterns. Baseline 3 is appropriate when schema does all the parameter documentation work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Check') and resource ('VEX vulnerability status for specific products'). It distinguishes from siblings like 'cve_lookup' or 'search_vulnerabilities' by focusing on VEX status rather than general vulnerability information. However, it doesn't explicitly differentiate from all siblings in the description text itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'cve_lookup' or 'get_exploit_availability'. It mentions checking VEX status but doesn't explain when this is preferable to other vulnerability assessment tools. There's no mention of prerequisites, limitations, or specific contexts where this tool is most appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_vulnerability_timelineC

Get vulnerability timeline and patch status information

ParametersJSON Schema
NameRequiredDescriptionDefault
cve_idYesGet comprehensive timeline and patch status information for a vulnerability including publication dates, disclosure timeline, patch availability, vendor advisories, and remediation guidance. Provide a CVE ID in the format CVE-YYYY-NNNN (e.g., CVE-2021-44228). Essential for understanding vulnerability lifecycle and planning patch management strategies.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions what information is retrieved but doesn't cover critical aspects like whether this is a read-only operation, potential rate limits, authentication requirements, or the format of the returned data. This leaves significant gaps for an agent to understand how to interact with the tool effectively.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without any unnecessary words. It's front-loaded and easy to parse, making it highly concise and well-structured for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is insufficient for a tool that retrieves detailed vulnerability information. It doesn't explain what the output looks like (e.g., timeline format, patch status details), nor does it address behavioral traits like data freshness or error handling, leaving the agent with incomplete context for proper usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with the 'cve_id' parameter well-documented in the schema itself. The description doesn't add any meaningful information beyond what's already in the schema (e.g., it doesn't clarify parameter usage or constraints), so it meets the baseline score for high schema coverage without compensating value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Get') and resource ('vulnerability timeline and patch status information'), making it immediately understandable. However, it doesn't explicitly differentiate this tool from its siblings like 'cve_lookup' or 'search_vulnerabilities', which might also provide vulnerability information, so it doesn't reach the highest score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. With siblings like 'cve_lookup' and 'search_vulnerabilities' available, there's no indication of what makes this tool unique or when it should be preferred over others, leaving the agent to guess based on the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_vulnerability_checkA

Check for known vulnerabilities in Python packages using OSV database

ParametersJSON Schema
NameRequiredDescriptionDefault
package_nameYesName of the Python package to check for vulnerabilities (e.g., 'requests', 'django', 'flask')
versionNoSpecific version to check (optional). If not provided, checks all known versions.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool checks for vulnerabilities using the OSV database, which implies a read-only, non-destructive operation, but does not detail rate limits, authentication needs, error handling, or response format. It adds some context but leaves significant behavioral aspects unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is appropriately sized and front-loaded, with every part contributing essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 parameters, no output schema, no annotations), the description is minimally adequate. It covers the basic purpose but lacks details on behavioral traits, output format, or integration with sibling tools, leaving gaps that could hinder effective use by an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents both parameters ('package_name' and 'version'). The description does not add any additional meaning beyond what the schema provides, such as examples or edge cases, resulting in a baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Check for known vulnerabilities') and target resource ('Python packages using OSV database'), distinguishing it from siblings like 'cve_lookup' or 'search_vulnerabilities' by focusing on package-level vulnerability assessment rather than CVE-specific queries or broader searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for Python packages but does not explicitly state when to use this tool versus alternatives like 'cve_lookup' for CVE details or 'search_vulnerabilities' for broader queries. It provides basic context but lacks explicit guidance on exclusions or comparisons with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_vulnerabilitiesC

Search vulnerability databases with advanced filtering

ParametersJSON Schema
NameRequiredDescriptionDefault
keywordsNoSearch vulnerability databases with advanced filtering capabilities to find relevant security threats. Filter by keywords (e.g., 'apache', 'sql injection'), severity levels (CRITICAL, HIGH, MEDIUM, LOW), and date ranges (30d, 90d, 1y, 2y). Enables comprehensive threat research and vulnerability landscape analysis across multiple CVE and vulnerability databases.
severityNoFilter by severity level: CRITICAL, HIGH, MEDIUM, LOW, NONE
date_rangeNoDate range filter. Use predefined ranges (30d, 90d, 1y, 2y) or custom format YYYY-MM-DD,YYYY-MM-DD

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'advanced filtering' and 'comprehensive threat research,' but lacks critical details such as whether this is a read-only operation, if it requires authentication, rate limits, pagination behavior, or what databases it searches. This leaves significant gaps for safe and effective tool invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It's front-loaded with the core action ('Search vulnerability databases') and qualifies it succinctly ('with advanced filtering'), making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of vulnerability searching, no annotations, and no output schema, the description is incomplete. It doesn't address key aspects like the scope of databases searched, result format, error handling, or performance considerations, which are essential for an agent to use this tool effectively in security contexts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all three parameters thoroughly. The description adds no additional parameter semantics beyond what's in the schema, such as explaining interactions between filters or default behaviors. This meets the baseline for high schema coverage but doesn't enhance understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as 'Search vulnerability databases with advanced filtering,' which is a specific verb+resource combination. However, it doesn't explicitly distinguish this tool from its siblings like 'cve_lookup' or 'package_vulnerability_check,' which likely perform similar vulnerability-related searches with different scopes or methods.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus its siblings. It mentions 'advanced filtering' but doesn't specify scenarios where this is preferred over alternatives like 'cve_lookup' for direct CVE lookups or 'package_vulnerability_check' for package-specific checks, leaving the agent to guess based on context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 8 tool updates
    • First observedcalculate_cvss_score
    • First observedcve_lookup
    • First observedget_epss_score
    • First observedget_exploit_availability
    • First observedget_vex_status
    • First observedget_vulnerability_timeline
    • First observedpackage_vulnerability_check
    • First observedsearch_vulnerabilities
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.7/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose within the vulnerability domain: CVSS scoring, CVE lookup, EPSS scoring, exploit availability, VEX status, timeline tracking, package checking, and vulnerability search. No tools appear to overlap or cause confusion, as each targets a specific aspect of vulnerability assessment.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern (e.g., calculate_cvss_score, get_epss_score, search_vulnerabilities). The naming is uniform across the set, using descriptive verbs like 'calculate', 'get', 'check', and 'search' paired with clear nouns, making it easy to understand each tool's function.

Tool Count5/5

With 8 tools, the server is well-scoped for vulnerability checking, covering key areas like scoring, lookup, exploit assessment, and package analysis. Each tool earns its place by addressing a distinct need in the domain, avoiding both bloat and gaps in functionality.

Completeness5/5

The tool set provides comprehensive coverage for vulnerability assessment, including scoring (CVSS, EPSS), information retrieval (CVE lookup, timeline), exploit analysis, package checks, and search capabilities. There are no obvious gaps; it supports a full workflow from detection to prioritization.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • MCP NVD Server

    gkhays
    A
    license
    B
    quality
    D
    maintenance
    A Model Context Protocol server that retrieves CVE information from the National Vulnerability Database, allowing AI models to access up-to-date vulnerability data.
    1
    7
    Apache 2.0

  • Socket MCP Server

    SocketDev
    A
    license
    A
    quality
    A
    maintenance
    A Model Context Protocol (MCP) server for Socket integration, allowing AI assistants to efficiently check dependency vulnerability scores and security information.
    1
    1,665
    132
    MIT

  • vuln-nist-mcp-server

    HaroldFinchIFT
    A
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server for querying the NIST National Vulnerability Database (NVD) API, enabling search and retrieval of CVE details, temporal context, and KEV catalog entries.
    15
    MIT

  • NIST NVD MCP Server

    Cyreslab-AI
    A
    license
    A
    quality
    D
    maintenance
    Enables AI agents to search, retrieve, and analyze vulnerability data from the NIST National Vulnerability Database through a comprehensive Model Context Protocol server.
    8
    8
    MIT

Appeared in Searches

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/firetix/vulnerability-intelligence-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server