vuln-intel-mcp

A local MCP server that gives any AI agent — Claude Desktop, Claude Code, Cline, Cursor, or your own — CVE remediation intelligence from public sources: NVD, CISA KEV, and FIRST EPSS.

Your model does the reasoning. This server does not.

That is the whole point: the server only does the token-free work — fetching public vulnerability data over HTTP and computing an objective priority. It never calls an LLM, needs no API key, and sends nothing anywhere except read-only requests to public vulnerability databases. The remediation write-up and the ServiceNow note are produced by your model, in your session, from the structured facts the tools return. No one's API tokens are consumed but your own.

Built by Rohan Raj. A hosted demo with AI synthesis and a live cost ledger runs at clawofrohan.com/vuln-intel.

Install & connect

You need Python 3.10+. The easiest runner is uv (uvx downloads and runs on demand — nothing to install permanently).

Claude Code

claude mcp add vuln-intel -- uvx vuln-intel-mcp

Claude Desktop

Edit claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "vuln-intel": {
      "command": "uvx",
      "args": ["vuln-intel-mcp"]
    }
  }
}

Cline / Cursor / any MCP client

Same shape — command uvx, args ["vuln-intel-mcp"]. Or if you installed it with pip install vuln-intel-mcp, use command vuln-intel-mcp with no args.

Restart the client, and ask it something like "Should I patch CVE-2024-3400?" or "What's the exploit status of Log4Shell?"

Related MCP server: cve-lookup-mcp

Tools

Optional environment variables

All optional — the server works with none. These raise your own public-API rate limits:

• NVD_API_KEY — a free NVD API key for higher NVD throughput.

• GITHUB_TOKEN — a GitHub token for more GitHub repo searches in cve_exploit_intel.

Privacy

• No telemetry. No account. No key required.

• Outbound requests go only to services.nvd.nist.gov, api.first.org, cisa.gov, and (for exploit intel) api.github.com.

• The CVE ids and search terms you look up are sent to those public services, exactly as if you visited them in a browser.

License

MIT © Rohan Raj