CVE MCP server

An MCP server that finds known vulnerabilities in your dependencies and tells you which ones matter now.

The problem

npm audit, composer audit and similar tools list every known vulnerability in your dependencies, and on a real project that is often dozens or hundreds of entries, most marked "high". They don't tell you which ones attackers are using today, they only cover what is already installed, and turning the list into a decision (what to fix first, what to upgrade to, does it even apply to how we use the library) is left to you.

This server gives Claude (Claude Code, claude.ai, mobile) live access to the public vulnerability databases, so you can ask in plain language:

• "Scan this project's lockfiles: what must I fix today?"

• "Is laravel/framework 8.0.0 safe? What's the smallest upgrade that fixes the critical ones?"

• "Any new Laravel or Vite CVEs in the last 30 days?"

• "Does CVE-2025-30208 affect us, given we never expose the Vite dev server?"

It doesn't replace your audit in CI; it is what you use after it, to decide what to do.

Related MCP server: mcp-osv

How it works

1. Lookup. Packages and versions are checked against OSV.dev (which merges GitHub advisories, npm, Packagist, PyPI and more, including reports of malicious packages). CVE records come from CVE.org and keyword searches from NVD.

2. Risk. Every finding is enriched with two signals:

   • CISA KEV: is this vulnerability being exploited in the wild right now?

   • EPSS (FIRST.org): the probability it gets exploited in the next 30 days.

3. Ranking. Results are sorted most urgent first: actively exploited, then by EPSS. On one real project, 144 findings came down to 1 that was actively exploited.

4. Reasoning. Claude reads the advisories and your code to judge whether each one really applies and proposes the upgrade path.

Everything uses free public APIs; no account needed.

Tools

Every result carries exploited (listed in CISA KEV = attacked in the wild now) and epss (FIRST probability of exploitation in the next 30 days), and lists are sorted most urgent first. All sources are free and need no account. NVD_API_KEY (optional) raises NVD's rate limit.

Installation

Requirements

• Node.js 20 or newer

• An MCP client: Claude Code, Claude Desktop, claude.ai, or any other client that speaks MCP

No API keys are needed, and nothing to clone: npx downloads and runs the server from GitHub. Optionally get a free NVD API key to raise the NVD rate limit for search_cves, and pass it as the NVD_API_KEY environment variable.

Claude Code

claude mcp add cve --scope user -- npx -y github:AlessioMealli/mcp-cve-server

--scope user makes it available in every project. Check it with claude mcp list.

Claude Desktop

Open Settings → Developer → Edit Config (or edit the file directly: ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows) and add:

{
  "mcpServers": {
    "cve": {
      "command": "npx",
      "args": ["-y", "github:AlessioMealli/mcp-cve-server"]
    }
  }
}

Restart Claude Desktop.

Other MCP clients (Cursor, VS Code, Windsurf, ...)

Use the same stdio command in the client's MCP config: npx -y github:AlessioMealli/mcp-cve-server.

From source

git clone https://github.com/AlessioMealli/mcp-cve-server.git
cd mcp-cve-server
npm install --omit=dev

Then use node /absolute/path/to/mcp-cve-server/index.js as the command instead of npx.

Remote (claude.ai, Claude mobile, teams)

Run your own hosted instance (see Self-hosting), then:

• claude.ai / Claude Desktop / mobile: Settings → Connectors → Add custom connector, URL https://your-domain/mcp. Claude opens a consent page; paste your access token once.

• Claude Code: claude mcp add --transport http cve https://your-domain/mcp

Usage

Just ask Claude. Some prompts that work well:

Scan the lockfiles in this project and tell me what to fix first.
Check axios 0.21.0 on npm. Which version fixes everything?
Any CVEs about "wordpress" published in the last 7 days?
Explain CVE-2021-44228 and whether it is being exploited.

Locally, scan_lockfile reads a project folder by path (it finds composer.lock and package-lock.json). On a hosted server it takes the lockfile text in content + filename instead and never reads the server's disk.

Configuration

Under Phusion Passenger (Plesk, cPanel) the hosted mode starts automatically and Passenger handles the port.

Self-hosting

The hosted mode serves /mcp (Streamable HTTP), the OAuth 2.1 endpoints Claude uses to log in, and /health.

PORT=3000 PUBLIC_URL=https://cve.example.com CVE_AUTH_TOKEN=... node index.js

Put it behind an HTTPS reverse proxy (nginx, Caddy, ...) that sets X-Real-IP or X-Forwarded-For, then check https://cve.example.com/health returns {"ok":true,...}. Keep the token in the environment, never in a file in the repo.

1. DNS: an A record for the subdomain pointing to your server.

2. Plesk: add the subdomain with Document Root <subdomain>/public (an empty folder, so the app's files are never served) and a Let's Encrypt certificate.

3. Git: add this repository, deploy to the subdomain root, deployment action bash deploy.sh (installs dependencies and restarts the app). Add Plesk's webhook URL to the GitHub repo to deploy on every push.

4. Node.js: Application Root = subdomain root, Startup File app.js, mode production, and set CVE_AUTH_TOKEN, PUBLIC_URL and optionally NVD_API_KEY. Then NPM install and Restart.

Giving access to other people

The owner token always works. Everyone else gets their own token, kept in tokens.json (mode 600, never committed). Run these in the app folder, as the user the app runs as:

node tokens.js add elena "Elena Rossi"   # prints her token once
node tokens.js list                      # who has access (never prints tokens)
node tokens.js remove elena              # revoke

Give the person the connector URL and their token. Removing someone cuts off their Claude connection on its next request, with no restart. Lost token: remove and add again.

Security

• The hosted server refuses to start without a strong CVE_AUTH_TOKEN.

• Access and refresh tokens are HMAC-signed and checked against the people list on every request, so revoking someone is immediate.

• Wrong tokens on the consent page are limited to 10 per minute per IP, and the consent form only redirects to addresses the OAuth client registered.

• Every login and tool call is logged as one JSON line with the person's id ("tenant":"elena"), never the token or lockfile contents.

• The hosted scan_lockfile does not accept file paths.

Found a security issue in this server? Please open a private security advisory rather than a public issue.

Development

npm install
npm test

npm test runs two live tests against the real APIs: test.js (stdio: every tool, lockfile parsing and ranking) and test-http.js (hosted mode: full OAuth flow, throttle, redirect check, people add/login/remove, tampered token, 2 MB lockfile, no server paths).

Data sources

CVE.org, NVD, OSV.dev, CISA KEV and FIRST EPSS. This project is not affiliated with any of them.

License

MIT