Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@vulnscan-mcp what are the latest critical CVEs from the past week?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Vulnerability Intelligence MCP Server — an enterprise-grade Model Context Protocol server providing AI agents with real-time, correlated vulnerability intelligence.
vulnscan-mcp unifies data from four intelligence sources into a single normalized data fabric:
NIST NVD 2.0 — CVE details, CVSS scores, CWE classifications, CPE patterns
CISA KEV — Known Exploited Vulnerabilities catalog with active exploitation status
FIRST.org EPSS — Exploit Prediction Scoring System probability scores
MITRE ATT&CK — Adversary tactic and technique mappings
Related MCP server: Cybersecurity Threat Intelligence MCP
🔍 5 MCP Tools for vulnerability search, CVE details, critical CVE tracking, KEV monitoring, and EPSS scoring
🔄 Automated Background Sync — NVD delta (2h), CISA KEV (12h), EPSS batch (24h) via APScheduler
💾 SQLite + FTS5 — Full-text search with 67K+ pre-loaded CVE records
🚀 Triple Transport — stdio for local IDE agents, sse + streamable-http on port 8001 for network agents
🐳 Docker Ready — Multi-stage build with non-root user
Python 3.11+
uv package manager
# Clone and install
git clone <repo-url> vulnscan-mcp
cd vulnscan-mcp
cp .env.example .env
# Edit .env with your NVD API key
uv sync# stdio mode (for Claude Desktop, Claude Code)
uv run vulnscan-mcp --transport stdio
# Network mode on port 8001 — serves both SSE and Streamable HTTP simultaneously
uv run vulnscan-mcp --transport sse --port 8001When running in network mode, the server exposes:
SSE at /sse (+ /messages for POST)
Streamable HTTP at /mcp
Health check at /
docker compose up -d
# SSE endpoint: http://localhost:8001/sse
# Streamable HTTP endpoint: http://localhost:8001/mcpTool | Description |
| Search CVEs by keyword, severity, date range, KEV status |
| Deep 360° enriched profile for a specific CVE |
| Recently published critical vulnerabilities |
| Top actively exploited vulnerabilities from CISA KEV |
| EPSS exploitation probability for one or more CVEs |
{
"mcpServers": {
"vulnscan": {
"command": "uv",
"args": [
"--directory", "/path/to/vulnscan-mcp",
"run", "vulnscan-mcp",
"--transport", "stdio"
],
"env": {
"NVD_API_KEY": "your_key_here"
}
}
}
}docker run -d -p 8001:8001 -v $(pwd)/data:/app/data --env-file .env vulnscan-mcp:latestConnect to: http://localhost:8001/sse
The server supports Streamable HTTP transport at the /mcp endpoint, which is the protocol used by ChatGPT and the OpenAI Responses API.
ChatGPT Plugin:
Add as a remote MCP server in ChatGPT settings using the URL:
https://your-domain.com/mcpOpenAI Responses API:
from openai import OpenAI
client = OpenAI()
resp = client.responses.create(
model="gpt-4o",
tools=[
{
"type": "mcp",
"server_label": "vulnscan",
"server_description": "Vulnerability Intelligence MCP Server",
"server_url": "https://your-domain.com/mcp",
"require_approval": "never",
},
],
input="What are the latest critical CVEs from the past 7 days?",
)
print(resp.output_text)Note: ChatGPT requires your server to be reachable over HTTPS. For local/private servers, use OpenAI's Secure MCP Tunnel to expose your server without making it publicly accessible.
Variable | Default | Description |
| — | NVD API key for higher rate limits |
|
| Transport: |
|
| Network server port (serves both SSE and Streamable HTTP) |
|
| NVD delta sync interval |
|
| CISA KEV sync interval |
|
| EPSS batch enrichment interval |
MIT
Retrieve a comprehensive, deeply enriched 360-degree security profile for a CVE.
Returns NVD CVSS scores, CISA KEV active exploitation status, FIRST.org EPSS exploitation probability, MITRE ATT&CK tactics/techniques, and risk assessment.
Args: cve_id: Standardized CVE identifier (e.g., 'CVE-2021-44228', 'CVE-2024-3094').
Inputs: cve_id (required). Returns: result
Query EPSS real-time exploitation probability scores for one or more CVEs.
Checks local cache first, then fetches from FIRST.org EPSS API for cache misses.
Args: cve_ids: List of CVE identifiers (e.g., ['CVE-2023-34362', 'CVE-2024-21887']).
Inputs: cve_ids (required). Returns: result
Fetch newly published critical vulnerabilities from the synchronized database.
Args: days: Past calendar days to search (1-90, default: 7). min_cvss: Minimum base CVSS score threshold (7.0-10.0, default: 9.0). limit: Number of records to retrieve (1-50, default: 10).
Inputs: days, limit, min_cvss. Returns: result
Fetch actively exploited vulnerabilities from the CISA KEV catalog.
Returns KEV entries ordered by recent addition or EPSS threat probability.
Args: limit: Number of KEV items to return (1-50, default: 10). sort_by: Sort order — 'date_added' for newest or 'epss_score' for highest exploitation probability.
Inputs: limit, sort_by. Returns: result
Search and filter vulnerabilities across local storage and synchronized feeds.
Search by keyword (CVE ID, component, vendor, description), filter by severity (LOW/MEDIUM/HIGH/CRITICAL), publication date range, and CISA KEV status.
Args: keyword: Search term matching CVE ID, component, vendor, or description. severity: Filter by CVSS severity: LOW, MEDIUM, HIGH, or CRITICAL. pubStartDate: Start publication date in ISO-8601 format (e.g., '2024-01-01'). pubEndDate: End publication date in ISO-8601 format (e.g., '2024-12-31'). hasKev: If True, filters for CVEs in the CISA Known Exploited Vulnerabilities catalog. limit: Maximum records to return (1-50, default: 20).
Inputs: limit, hasKev, keyword, severity, +2 more. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 5 tools
Tools have distinct purposes: search_vulnerabilities is broad search, get_cve_details is deep dive for one CVE, get_latest_critical_cves is time-based filter, get_top_kevs is KEV catalog, get_epss_score is EPSS scores. Overlap exists between get_latest_critical_cves and search_vulnerabilities (can achieve similar results via filters), but descriptions clarify each tool's niche.
All tool names consistently follow a verb_noun pattern (search_vulnerabilities, get_cve_details, get_latest_critical_cves, get_top_kevs, get_epss_score), with clear action verbs and descriptive nouns. No deviations in style (all snake_case).
5 tools is well-scoped for a vulnerability scanning server, covering search, detail retrieval, critical alerts, KEV catalog, and EPSS scores without redundancy. Each tool earns its place.
Coverage is strong: search, details, latest criticals, KEV list, and EPSS scores. However, there's no tool for CVE enumeration by vendor/component or bulk export/update, which might be needed for full lifecycle. Minor gaps but core use cases are covered.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
