<div align="center">

# 🛰️ security-intel-mcp

**A Model Context Protocol (MCP) server that gives Claude real vulnerability intelligence — CVE lookup (NVD), EPSS exploit-probability, and CISA KEV status — from free public APIs. No API key required.**

![MCP](https://img.shields.io/badge/MCP-server-2B50E4?style=for-the-badge)
![Python](https://img.shields.io/badge/Python-3.10%2B-3776AB?style=for-the-badge&logo=python&logoColor=white)
![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge)

</div>

---

## 📖 What this is

When triaging a vulnerability, three questions matter: *what is it, how likely is it to be exploited,
and is it already being exploited in the wild?* This MCP server answers all three from authoritative
free sources, so an AI assistant can prioritize CVEs by **real-world risk** — not CVSS alone.

## 🧰 Tools

| Tool | Source | Returns |
|------|--------|---------|
| `cve_lookup(cve_id)` | NVD | Description, publish date, CVSS severity |
| `epss_score(cve_id)` | FIRST EPSS | Probability of exploitation (next 30 days) + percentile |
| `kev_check(cve_id)` | CISA KEV | Whether it's known-exploited, with due date & required action |
| `cve_enrich(cve_id)` | all three | One combined, prioritized risk view |

`cve_enrich` applies a transparent rule: **KEV > high EPSS > high CVSS** — the same logic a good
vulnerability-management program uses.

## ⚙️ Install

```bash
git clone https://github.com/devsecforge/security-intel-mcp.git
cd security-intel-mcp
pip install -r requirements.txt
```

## ▶️ Use with Claude Desktop

Add to your `claude_desktop_config.json` (see [examples/](examples/claude_desktop_config.json)):

```json
{
  "mcpServers": {
    "security-intel": {
      "command": "python",
      "args": ["/absolute/path/to/security-intel-mcp/server.py"]
    }
  }
}
```

Restart Claude Desktop, then ask: *"Enrich CVE-2021-44228 and tell me if I should patch it now."*
Claude will call `cve_enrich` and answer with NVD, EPSS, and KEV data.

## 🧪 Run standalone

```bash
python server.py    # starts the MCP server over stdio
```

## 🔒 Notes
- Uses public, unauthenticated endpoints; be mindful of NVD rate limits for bulk use.
- Read-only intelligence — the server takes no actions and stores nothing.

## 🤝 Contributing & License
See **[CONTRIBUTING.md](CONTRIBUTING.md)**. [MIT](LICENSE) © 2026 devsecforge (S. Naz). Original work.