Provides access to FIRST EPSS data for CVE IDs, returning the probability of exploitation in the next 30 days along with percentile ranking.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@security-intel-mcp enrich CVE-2021-44228 and tell me if I need to patch it now"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that gives Claude real vulnerability intelligence — CVE lookup (NVD), EPSS exploit-probability, and CISA KEV status — from free public APIs. No API key required.
When triaging a vulnerability, three questions matter: what is it, how likely is it to be exploited, and is it already being exploited in the wild? This MCP server answers all three from authoritative free sources, so an AI assistant can prioritize CVEs by real-world risk — not CVSS alone.
Related MCP server: Exploit Intel Platform MCP Server
Tool | Source | Returns |
| NVD | Description, publish date, CVSS severity |
| FIRST EPSS | Probability of exploitation (next 30 days) + percentile |
| CISA KEV | Whether it's known-exploited, with due date & required action |
| all three | One combined, prioritized risk view |
cve_enrich applies a transparent rule: KEV > high EPSS > high CVSS — the same logic a good
vulnerability-management program uses.
git clone https://github.com/devsecforge/security-intel-mcp.git
cd security-intel-mcp
pip install -r requirements.txtAdd to your claude_desktop_config.json (see examples/):
{
"mcpServers": {
"security-intel": {
"command": "python",
"args": ["/absolute/path/to/security-intel-mcp/server.py"]
}
}
}Restart Claude Desktop, then ask: "Enrich CVE-2021-44228 and tell me if I should patch it now."
Claude will call cve_enrich and answer with NVD, EPSS, and KEV data.
python server.py # starts the MCP server over stdioUses public, unauthenticated endpoints; be mindful of NVD rate limits for bulk use.
Read-only intelligence — the server takes no actions and stores nothing.
See CONTRIBUTING.md. MIT © 2026 devsecforge (S. Naz). Original work.
This server cannot be deployed
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
