# CVE Intelligence MCP

A lightweight, read-only Streamable HTTP MCP server for the official
[CVE List V5](https://github.com/CVEProject/cvelistV5). It retrieves records
on demand from the upstream repository and enriches them with the public
[CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

## Tools

- `get_cve`: CVE metadata, descriptions, affected products and versions, metrics,
  references, and KEV status.
- `get_cves`: batch lookup for up to 25 CVE IDs.
- `get_required_action`: affected products, official references, and CISA's required
  action when the CVE is in KEV.

## Run locally

```bash
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
uvicorn server:app --host 127.0.0.1 --port 8000
```

Connect an MCP client using Streamable HTTP:

```text
http://127.0.0.1:8000/mcp
```

## Deploy to Render

Create a Render Blueprint from this repository. `render.yaml` contains the build
and start commands. The deployed endpoint is:

```text
https://<render-service-name>.onrender.com/mcp
```

## Data and operational notes

- CVE data is fetched from the official CVEProject repository at request time.
- CISA KEV is cached in memory for one hour.
- The service is read-only and does not modify upstream data.
- Vendor advisories referenced by the CVE record remain the authoritative source
  for exact patch versions and mitigations.
- The Render free plan can spin down when idle, so the first request may be slow.

## License

Server code is provided under the Apache-2.0 license. Upstream CVE records remain
subject to the CVE Program terms of use and their record-level provenance.