vulnscan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_PORT | No | Network server port (serves both SSE and Streamable HTTP) | 8001 |
| NVD_API_KEY | No | NVD API key for higher rate limits | |
| MCP_TRANSPORT | No | Transport: stdio, sse, http, or streamable-http | sse |
| KEV_SYNC_INTERVAL_HOURS | No | CISA KEV sync interval | 12 |
| NVD_SYNC_INTERVAL_HOURS | No | NVD delta sync interval | 2 |
| EPSS_SYNC_INTERVAL_HOURS | No | EPSS batch enrichment interval | 24 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_vulnerabilitiesA | Search and filter vulnerabilities across local storage and synchronized feeds. Search by keyword (CVE ID, component, vendor, description), filter by severity (LOW/MEDIUM/HIGH/CRITICAL), publication date range, and CISA KEV status. Args: keyword: Search term matching CVE ID, component, vendor, or description. severity: Filter by CVSS severity: LOW, MEDIUM, HIGH, or CRITICAL. pubStartDate: Start publication date in ISO-8601 format (e.g., '2024-01-01'). pubEndDate: End publication date in ISO-8601 format (e.g., '2024-12-31'). hasKev: If True, filters for CVEs in the CISA Known Exploited Vulnerabilities catalog. limit: Maximum records to return (1-50, default: 20). |
| get_cve_detailsA | Retrieve a comprehensive, deeply enriched 360-degree security profile for a CVE. Returns NVD CVSS scores, CISA KEV active exploitation status, FIRST.org EPSS exploitation probability, MITRE ATT&CK tactics/techniques, and risk assessment. Args: cve_id: Standardized CVE identifier (e.g., 'CVE-2021-44228', 'CVE-2024-3094'). |
| get_latest_critical_cvesB | Fetch newly published critical vulnerabilities from the synchronized database. Args: days: Past calendar days to search (1-90, default: 7). min_cvss: Minimum base CVSS score threshold (7.0-10.0, default: 9.0). limit: Number of records to retrieve (1-50, default: 10). |
| get_top_kevsA | Fetch actively exploited vulnerabilities from the CISA KEV catalog. Returns KEV entries ordered by recent addition or EPSS threat probability. Args: limit: Number of KEV items to return (1-50, default: 10). sort_by: Sort order — 'date_added' for newest or 'epss_score' for highest exploitation probability. |
| get_epss_scoreA | Query EPSS real-time exploitation probability scores for one or more CVEs. Checks local cache first, then fetches from FIRST.org EPSS API for cache misses. Args: cve_ids: List of CVE identifiers (e.g., ['CVE-2023-34362', 'CVE-2024-21887']). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Tools have distinct purposes: search_vulnerabilities is broad search, get_cve_details is deep dive for one CVE, get_latest_critical_cves is time-based filter, get_top_kevs is KEV catalog, get_epss_score is EPSS scores. Overlap exists between get_latest_critical_cves and search_vulnerabilities (can achieve similar results via filters), but descriptions clarify each tool's niche.
All tool names consistently follow a verb_noun pattern (search_vulnerabilities, get_cve_details, get_latest_critical_cves, get_top_kevs, get_epss_score), with clear action verbs and descriptive nouns. No deviations in style (all snake_case).
5 tools is well-scoped for a vulnerability scanning server, covering search, detail retrieval, critical alerts, KEV catalog, and EPSS scores without redundancy. Each tool earns its place.
Coverage is strong: search, details, latest criticals, KEV list, and EPSS scores. However, there's no tool for CVE enumeration by vendor/component or bulk export/update, which might be needed for full lifecycle. Minor gaps but core use cases are covered.