How do I use EPSS MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@EPSS MCP Server Get EPSS score for CVE-2024-12345" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

EPSS MCP Server

by kodamap

Overview Schema Source Related Servers Discussions Admin

Python

Remote

1. EPSS MCP Server

Note: The major design of code in this repository is based on EPSS-MCP.

2. Features

EPSS MCP Server provides the following features:

Retrieve vulnerability details (including description, CWE, and CVSS scores) from the NVD API, and EPSS scores and percentiles from the EPSS API.
Retrieve EPSS scores for multiple CVEs.
Retrieve the EPSS time series data for a single CVE.
Retrieve the top N CVEs with the highest EPSS scores.

3. Run MCP Server on Docker

Note: If you want to change transport type, edit Dockerfile like this.

# Stdio transport(Default)
CMD ["python3", "epss_mcp.py", "--transport", "stdio"]
# SSE transport
CMD ["python3", "epss_mcp.py", "--transport", "sse"]
# Streamable HTTP transport
CMD ["python3", "epss_mcp.py", "--transport", "http"]

Build docker image

cd epss-mcp
docker build -t epss-mcp .

Run MCP server

# Stdio transport
docker run --rm -i epss-mcp

# SSE transport (Access from localhost only is recommended)
docker run -d -p 127.0.0.1:8000:8000 epss-mcp

# Streamable HTTP transport (Access from localhost only is recommended)
docker run -d -p 127.0.0.1:8000:8000 epss-mcp

4. Installation

4.1. Stdio

Prepare a Python virtual environment using uv. See uv for more details.

curl -LsSf https://astral.sh/uv/install.sh | sh

uv sync
. .venv/bin/activate

Cursor, Windsurf

{
  "mcpServers": {
    "epss-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "epss-mcp"
      ]
    }
  }
}

Related MCP server: Cybersecurity Threat Intelligence MCP

4.2. Streamable HTTP, SSE

Cursor

{
  "mcpServers": {
    "epss-mcp": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

Windsurf

serverUrl is your server URL or IP address.

{
  "mcpServers": {
    "epss-mcp": {
      "serverUrl": "http://localhost:8000/sse"
    }
  }
}

Windsurf supports two transport types for MCP servers: stdio and /sse https://docs.windsurf.com/windsurf/cascade/mcp

5. Tool Examples

This example is simply demonstrating how each function works, so it's executed using a Python script as the MCP client. (You can use them via an LLM through editors like Cursor or Windsurf.)

Note: MCP client for testing purposes. (Gemini API Key required)

export GOOGLE_API_KEY=<your api key>

Start the MCP server with stdio transport

$ uv run client/client.py epss-mcp/epss_mcp.py

Connected to server with tools: ['get_cve_info', 'top_epss_cves']

MCP Client Started!
Type your queries or `quit` to exit.

Query:

5.1. Get EPSS Score of single CVE

Query: Get EPSS of CVE-2025-33053
> Thinking...

 [Calling tool get_cve_info with args {'cve_id': 'CVE-2025-33053'}]
The EPSS score for CVE-2025-33053 is 0.41763, and the percentile is 97.264.

5.2. Get EPSS Score of multiple CVEs

Query: Get EPSS of CVE-2025-33053, CVE-2025-21298
> Thinking...

 [Calling tool get_cve_info with args {'cve_id': 'CVE-2025-33053,CVE-2025-21298'}]
CVE-2025-33053 has an EPSS score of 0.41763 and is in the 97.264 percentile. CVE-2025-21298 has an EPSS score of 0.70558 and is in the 98.593 percentile.

5.3. Get EPSS Score of multiple CVEs with time series

Query: Get time series of CVE-2025-33053 with table format

> Thinking...

 [Calling tool get_cve_info with args {'cve_id': 'CVE-2025-33053', 'time_series': True}]
Here is the time series data for CVE-2025-33053 in a table format:

| Date       | EPSS       | Percentile |
|------------|------------|------------|
| 2025-07-07 | 0.417630000 | 0.972650000 |
| 2025-07-06 | 0.37155000 | 0.96976000 |
| 2025-07-01 | 0.32398000 | 0.96662000 |
| 2025-06-30 | 0.30219000 | 0.96437000 |
| 2025-06-23 | 0.15008000 | 0.94213000 |
| 2025-06-18 | 0.16497000 | 0.94551000 |
| 2025-06-16 | 0.18266000 | 0.94860000 |
| 2025-06-15 | 0.32831000 | 0.96637000 |
| 2025-06-13 | 0.27895000 | 0.96193000 |
| 2025-06-12 | 0.53232000 | 0.97806000 |
| 2025-06-11 | 0.54359000 | 0.97862000 |

5.4. Get top 5 CVEs with the highest EPSS scores

uv run client_stdio.py ../epss-mcp/epss_mcp.py --top_n 5

> Thinking...

 [Calling tool top_epss_cves with args {'top_n': 5}]
Here are the top 5 CVEs with the highest EPSS scores:
CVE-2023-42793, EPSS score: 0.94584, EPSS percentile: 100.0
CVE-2024-27198, EPSS score: 0.94577, EPSS percentile: 100.0
CVE-2023-23752, EPSS score: 0.94532, EPSS percentile: 100.0
CVE-2024-27199, EPSS score: 0.94489, EPSS percentile: 99.99900000000001
CVE-2018-7600, EPSS score: 0.94489, EPSS percentile: 99.99900000000001

6. Reference

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

sectora A
io.github.megabrainee
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
Security Monitoring AI & Machine Learning
142
cve-intelligence A
com.cve-security
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Security Monitoring Observability
81
Security Intel MCP A
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
31
Security Intel MCP A
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2

Related MCP Servers

CVE Intelligence MCP Server
Penetration Testing Security
gopichand458
A
license
Not graded
quality
D
maintenance
Provides multi-source vulnerability intelligence for AI-powered security operations, combining NVD CVSS, CISA KEV, and EPSS scores without requiring an API key.
Updated 7 months ago (2026-02-15 15:08 UTC)
1
MIT
Cybersecurity Threat
Security Penetration Testing Research & Data
FoundryNet
A
license
Not graded
quality
F
maintenance
Provides CVE search enriched with EPSS exploit likelihood and CISA KEV status, plus live IP/domain reputation and a real-time threat feed for AI agents.
Updated a month ago (2026-08-11 06:21 UTC)
MIT
cve-lookup-mcp
Security Open Data
Aashish-32
A
license
A
quality
C
maintenance
Provides live CVE data from NVD and EPSS without API key, enabling AI assistants to look up CVSS scores, search vulnerabilities, and check product CVEs.
Updated 3 months ago (2026-06-21 11:17 UTC)
3
MIT
vuln-intel-mcp
Security Penetration Testing
rohanrajnist
A
license
Not graded
quality
C
maintenance
Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
Updated 2 months ago (2026-07-06 06:18 UTC)
1
MIT