Which integrations are available for this server?

Integrates with Abuse.ch ThreatFox to fetch threat intelligence indicators. Integrates with arXiv to fetch computer science cryptography and security research papers. Integrates with GitHub Security Advisories and PoC (Proof of Concept) search for vulnerability intelligence.

How do I use secfeed?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@secfeed show me the latest CVEs" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

secfeed

Security Intelligence MCP server — aggregates authoritative vulnerability, news, and threat-intel feeds into a local SQLite database and serves them to AI agents via MCP tools.

Every ingested item is auto-classified against the agent-security-manual threat taxonomy (TH-01..TH-10), so agents can pull an AI-agent-security focused feed and trace each threat to its mitigating controls (CT), requirements (REQ), and manual chapters.

Data sources

Category	Sources
Vulnerabilities	CISA KEV, NVD CVE API 2.0, EPSS, GitHub Security Advisories, GitHub PoC search
Threat intel	Abuse.ch ThreatFox, CISA Cybersecurity Advisories, arXiv cs.CR
News	The Hacker News, BleepingComputer, Krebs on Security, The Record, SANS ISC
Agent security	Simon Willison's blog, Embrace The Red

Related MCP server: wrg-mcp-server

MCP tools

Tool	Purpose
`get_latest_cves`	Recent CVEs sorted by EPSS exploit probability
`get_cisa_kev`	Known Exploited Vulnerabilities (confirmed in-the-wild)
`get_security_news`	Aggregated security news
`search_security`	FTS5 full-text search across all data
`get_cve_detail`	On-demand NVD + EPSS lookup for one CVE
`get_threat_summary`	24h threat landscape briefing + feed health
`get_agent_threat_feed`	Items tagged with agent threat classes TH-01..TH-10
`lookup_taxonomy`	Resolve TH/CT ids to controls, REQs, and manual chapters
`get_agent_security_digest`	Per-threat-class activity digest for posture review

Agent threat taxonomy

Classification is a deterministic two-tier keyword classifier (taxonomy.py): strong agent-specific patterns always tag; generic security terms tag only when AI/agent context is present in the same text. No LLM calls — results are reproducible and auditable.

ID	Threat class
TH-01	Prompt injection (direct / indirect)
TH-02	Tool abuse / privilege escalation
TH-03	RAG / knowledge-base poisoning
TH-04	Memory / context contamination
TH-05	Agent identity / authority abuse
TH-06	Delegation / multi-agent abuse
TH-07	Supply-chain / MCP / plugin compromise
TH-08	Data exfiltration / secret exposure
TH-09	Audit / evaluation evasion
TH-10	Model / service abuse

Deployment

docker compose up -d --build
docker logs --tail 80 secfeed

Streamable HTTP: http://<host>:8888/mcp (put a reverse proxy with auth in front for public exposure)
stdio mode: python3 server.py --stdio
Data volume: secfeed-data mounted at /data (SQLite + FTS5)

Environment variables

Variable	Purpose
`NVD_API_KEY`	Optional — higher NVD API rate limits
`GITHUB_TOKEN`	Optional — higher GitHub API rate limits
`SECFEED_DB_PATH`	DB path override (default `/data/secfeed.db`)

Secrets are injected via the compose environment block from the host environment — never commit them.

Development

python3 -m venv venv && venv/bin/pip install -r requirements.txt
SECFEED_DB_PATH=/tmp/secfeed-dev.db venv/bin/python3 server.py --stdio

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivitySlowing

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

Security Intel MCP A
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
Security Intel MCP A
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
threatcluster
io.github.Jam0k
Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.
Security Open Data Research & Data
11
protectwith-kb A
io.github.burademirung
AI-security knowledge as MCP: standards-mapped tools (OWASP, NIST, MITRE) for AI agents.
Security AI & Machine Learning
2

Related MCP Servers

Mallory MCP Serverofficial
Security Monitoring
malloryai
A
license
A
quality
F
maintenance
A robust Model Control Protocol server that enables AI agents to access real-time cyber threat intelligence and detailed information about vulnerabilities, threat actors, malware, and other cyber-security entities.
Updated 3 months ago (2026-06-26 12:57 UTC)
10
8
Apache 2.0
wrg-mcp-server
Security Penetration Testing Code Analysis
WRG-11
A
license
Not graded
quality
A
maintenance
An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
Updated 4 months ago (2026-06-10 18:22 UTC)
1
MIT
cve-mcp
Security Research & Data
badchars
A
license
A
quality
B
maintenance
Unifies NVD, EPSS, CISA KEV, GitHub Advisory, and OSV into a single MCP server, enabling AI agents to query vulnerability intelligence conversationally with 23 tools for incident response, prioritization, dependency audits, and threat monitoring.
Updated 10 days ago (2026-09-17 01:24 UTC)
41
245 npm
28
MIT
darknet-mcp-server
Security Blockchain
badchars
A
license
A
quality
D
maintenance
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
Updated 11 days ago (2026-09-15 21:54 UTC)
66
158 npm
457
MIT