# 🛡️ MCP Server: CVE Intelligence

A Model Context Protocol (MCP) server that provides **multi-source vulnerability intelligence** for AI-powered security operations. Combines three free, authoritative data sources into a single unified interface — no API key required.

> **"Should I panic about this CVE?"** — This server answers that question.

## Why This Server?

Most CVE tools give you just a CVSS score. But security teams need to know:
- **How severe is it?** → CVSS score (from NVD)
- **Is it being exploited RIGHT NOW?** → CISA KEV catalog
- **How LIKELY is exploitation?** → EPSS probability score

This server combines all three into a **single risk verdict**.

```
┌─────────────────────────────────────────────────────────┐
│           mcp-server-cve-intel                           │
│                                                          │
│  ┌─────────────┐  ┌──────────────┐  ┌───────────────┐  │
│  │ NVD (NIST)  │  │ CISA KEV     │  │  EPSS         │  │
│  │ CVE details │  │ Known        │  │  Exploit      │  │
│  │ CVSS scores │  │ Exploited    │  │  Prediction   │  │
│  │ References  │  │ Vulns catalog│  │  Probability  │  │
│  └──────┬──────┘  └──────┬───────┘  └───────┬───────┘  │
│         └────────────────┼──────────────────┘           │
│                          ▼                               │
│              🎯 UNIFIED RISK VERDICT                     │
│   "CVE-2021-44228: CVSS 10.0, ACTIVELY EXPLOITED,      │
│    97.5% chance of exploitation → 🚨 PATCH NOW"         │
└─────────────────────────────────────────────────────────┘
```

## Features

- 🔍 **CVE Lookup** — Full intelligence report from 3 sources for any CVE
- 🔎 **CVE Search** — Search vulnerabilities by keyword (product, vendor, type)
- 🚨 **CISA KEV Feed** — Latest actively exploited vulnerabilities
- 📊 **EPSS Scores** — Exploit probability predictions (next 30 days)
- 🎯 **Risk Verdicts** — Automated risk scoring combining all factors
- 🆓 **No API Key Required** — All data sources are free and public
- 🏠 **Local + Remote** — Supports both stdio and SSE transport

## Quick Start

### 1. Install

```bash
git clone https://github.com/gopichand458/mcp-server-cve-intel.git
cd mcp-server-cve-intel
pip install -r requirements.txt
```

### 2. Run Local (for Claude Desktop)

```bash
python server.py
```

Add to your `claude_desktop_config.json`:

```json
{
    "mcpServers": {
        "cve-intel": {
            "command": "python",
            "args": ["/FULL/PATH/TO/mcp-server-cve-intel/server.py"]
        }
    }
}
```

### 3. Run Remote (shareable SSE server)

```bash
python server.py --remote
# → Available at http://localhost:8000/sse
```

### Optional: NVD API Key (for higher rate limits)

The server works without an API key, but NVD limits unauthenticated requests to 5 per 30 seconds. Get a free key for 50 requests/30 sec:

```bash
# Request key at: https://nvd.nist.gov/developers/request-an-api-key
export NVD_API_KEY="your-key-here"
python server.py
```

## Tools

### `cve_lookup` — Full CVE Intelligence Report

Get comprehensive intelligence for a specific CVE combining all 3 sources.

```
Input:  cve_lookup(cve_id="CVE-2021-44228")

Output: {
  "cve_id": "CVE-2021-44228",
  "description": "Apache Log4j2 <=2.14.1 JNDI features...",
  "cvss_score": 10.0,
  "severity": "CRITICAL",
  "epss": {
    "score_percent": "97.5%",
    "interpretation": "🔴 CRITICAL — Very high probability of exploitation"
  },
  "cisa_kev": {
    "in_kev_catalog": true,
    "actively_exploited": true,
    "known_ransomware_use": "Known"
  },
  "risk_verdict": {
    "overall": "🚨 CRITICAL — Immediate action required. Patch NOW.",
    "risk_score": "100/100",
    "risk_factors": [
      "🔴 CVSS Critical (9.0+)",
      "🔴 ACTIVELY EXPLOITED (in CISA KEV)",
      "🔴 USED IN RANSOMWARE CAMPAIGNS",
      "🔴 EPSS 97.5% — Very likely to be exploited"
    ]
  }
}
```

### `cve_search` — Search by Keyword

```
Input:  cve_search(keyword="Microsoft Exchange", limit=5)
Output: List of matching CVEs with CVSS scores and severity
```

### `cve_recent_kev` — Actively Exploited Vulnerabilities

```
Input:  cve_recent_kev(limit=10)
Output: Latest additions to CISA's Known Exploited Vulnerabilities catalog
```

### `cve_epss_score` — Exploit Probability

```
Input:  cve_epss_score(cve_id="CVE-2024-3094")
Output: EPSS score with probability and percentile interpretation
```

## Resources

| URI | Description |
|-----|-------------|
| `cve-intel://about` | Server info and data source details |
| `cve-intel://severity-guide` | CVSS/EPSS/KEV interpretation guide |

## Prompts

| Prompt | Description |
|--------|-------------|
| `vulnerability_assessment` | Guided CVE assessment workflow |
| `threat_briefing` | Current threat landscape briefing |

## Example Conversations

After connecting to Claude Desktop:

> **You:** "Tell me about CVE-2024-3094"
>
> **Claude:** *calls cve_lookup* → Provides full report with CVSS, EPSS, exploitation status, and risk verdict

> **You:** "What's being actively exploited right now?"
>
> **Claude:** *calls cve_recent_kev* → Lists latest CISA KEV additions with remediation guidance

> **You:** "Find vulnerabilities in Apache Struts and tell me which to patch first"
>
> **Claude:** *calls cve_search + cve_epss_score* → Searches, ranks by EPSS, recommends priority

## Data Sources

| Source | What It Provides | Rate Limit | Auth |
|--------|-----------------|------------|------|
| [NVD (NIST)](https://nvd.nist.gov) | CVE details, CVSS scores, CWEs, references | 5 req/30s (free), 50/30s (with key) | Optional |
| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Actively exploited CVEs, remediation deadlines | Unlimited | None |
| [EPSS (FIRST.org)](https://www.first.org/epss) | Exploit probability (0-100%) for next 30 days | Unlimited | None |

## Compatibility

| Client | Supported |
|--------|-----------|
| Claude Desktop | ✅ (stdio) |
| Claude Code | ✅ |
| Cursor | ✅ |
| VS Code + Copilot | ✅ |
| Any MCP client | ✅ |

## Project Structure

```
mcp-server-cve-intel/
├── server.py           # MCP server — tools, resources, prompts
├── cve_client.py       # Multi-source CVE intelligence client
├── requirements.txt    # Dependencies
├── LICENSE             # MIT License
├── .gitignore
└── README.md           # This file
```

## Contributing

Contributions welcome! Some ideas:
- Add more data sources (OSV, GitHub Security Advisories)
- Add caching for CISA KEV (it's a large JSON file)
- Add a `cve_compare` tool for side-by-side comparison
- Docker support
- PyPI packaging

## Author

**GKonakala** — [github.com/gopichand458](https://github.com/gopichand458)

## License

MIT License — see [LICENSE](LICENSE) for details.

## Disclaimer

## Disclaimer

This product uses the NVD API but is not endorsed or certified by the NVD.

This tool aggregates publicly available vulnerability data for security research 
and operational purposes. It is not affiliated with NIST, CISA, or FIRST.org. 
Always verify critical findings through official sources.

---

**Built with [Model Context Protocol](https://modelcontextprotocol.io) by Anthropic**