CVESentry MCP
# CVESentry MCP (Lite)
[](LICENSE)
[](https://python.org)
[](https://modelcontextprotocol.io)
**Autonomous Local Vulnerability Scanner, Fast CVE Search Engine & Dependency Audit Plane for AI Coding Agents**
CVESentry MCP gives AI coding agents (Claude Desktop, Cursor, Devin, Roo-Code) instant (<5ms) vulnerability intelligence without rate-limits or slow external API keys. It audits dependency manifests (`requirements.txt`, `package.json`), identifies vulnerable versions, and provides automated upgrade paths.
---
## 🚀 Features (Lite Edition)
- **Instant Local CVE Search (`search_cve`):** Query vulnerability records in sub-millisecond local SQLite memory with zero network dependencies.
- **Dependency Manifest Auditor (`audit_manifest`):** Parses `requirements.txt` and `package.json`, checks versions against vulnerable ranges, and calculates severity breakdowns.
- **CVE Detailed Metadata (`get_cve_details`):** Detailed CVSS score, vulnerability category, affected package version bounds, and security summaries.
- **Safe Version Recommendation (`get_safe_recommendation`):** Calculates the minimal patch version that eliminates all matching CVEs.
---
## 📦 Installation & Setup
```bash
git clone https://github.com/johannschiffer/cvesentry-mcp.git
cd cvesentry-mcp
pip install -e .
```
### Configuration with Claude Desktop / Cursor
Add to your `claude_desktop_config.json`:
```json
{
"mcpServers": {
"cvesentry": {
"command": "python3",
"args": ["-m", "cvesentry.server"]
}
}
}
```
---
## âš¡ Quick CLI Usage
```bash
# Search for a CVE or package
cvesentry search --query "aiohttp"
# Audit a requirements.txt file
cvesentry audit --file requirements.txt
```
---
## 💼 Upgrade to CVESentry Pro
Need enterprise security compliance for automated code generation?
- **Multi-Ecosystem Engine (SQLite WAL):** Full parsing for Python (`pyproject.toml`, `Pipfile`), Node (`package-lock.json`), Rust (`Cargo.lock`), and Go (`go.mod`).
- **EPSS & CISA KEV Exploit Prioritization:** Real-world Exploit Prediction Scoring System (EPSS) and CISA Known Exploited Vulnerabilities catalog integration.
- **Automated Safe Version Upgrader:** Automatically patches manifests while preserving semver constraints to minimize breaking changes.
- **Audit Certificate Exporter:** Generates formatted markdown and JSON reports for GitHub PR reviews.
- **Docker & Compose Ready:** Deploy as a microservice sidecar in your CI/CD cluster.
Available at [Gumroad](https://johanld.gumroad.com/).
---
## 📄 License
MIT © Johann Schiffer
TDQS
Scored across 4 tools
Each tool has a distinct primary purpose, but there is minor overlap: search_cve can search by CVE ID while get_cve_details retrieves full details for a CVE ID, and audit_manifest returns fix recommendations that overlap with get_safe_recommendation's single-package fix output. The descriptions still provide enough guidance to select correctly.
All four tool names follow a consistent snake_case verb_noun pattern (search_cve, audit_manifest, get_cve_details, get_safe_recommendation). There is no mixing of conventions or verb styles.
Four tools are well-scoped for a local CVE lookup and remediation server: search, audit, detailed lookup, and safe version recommendation. Each tool earns its place and the set is not bloated or thin.
The set covers the core lifecycle: lookup by ID/package/keyword, audit a manifest, retrieve full CVE metadata, and get a safe patch version. A minor gap is the lack of a direct 'is this version vulnerable?' query, though agents can infer this from search_cve or get_safe_recommendation.