Which integrations are available for this server?

Provides access to exploit intelligence from GitHub repositories, including exploit source code and metadata. Provides access to Metasploit module intelligence, including exploit analysis and framework integration.

How do I use Exploit Intel Platform MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Exploit Intel Platform MCP Server Get vulnerability brief for CVE-2024-6387" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Exploit Intel Platform MCP Server

by rhkiswani

Overview Schema Source Related Servers Discussions Admin

Hybrid

Exploit Intel Platform MCP Server

Package/command: eip-mcp

An MCP (Model Context Protocol) server that gives AI assistants access to the Exploit Intelligence Platform — vulnerability and exploit intelligence from NVD, CISA KEV, VulnCheck KEV, InTheWild.io, ENISA EUVD, OSV.dev, EPSS, ExploitDB, Metasploit, GitHub, and more. Supports both stdio and Streamable HTTP transport.

Part of the same project family:

eip-search — terminal client
eip-mcp — MCP server for AI assistants

Overview

Highlights

Give AI assistants real-time vulnerability and exploit intelligence
Query CVEs with rich filters and ranked exploit context
Include AI exploit analysis, MITRE ATT&CK mapping, and trojan indicators
Generate pentest findings directly from CVE data
Every exploit includes a clickable source URL (GitHub, ExploitDB, Metasploit)
Nuclei templates include description, impact, and remediation text
Run over stdio for desktop clients or Streamable HTTP for hosted deployments

What This Enables

With this MCP server, your AI assistant can:

Search vulnerabilities with 15+ filters (severity, vendor, product, EPSS, KEV, Nuclei, year, date range)
Choose score semantics explicitly when needed:
- legacy min_cvss stays CVSS v3-only
- min_score + score_version=v3|v4|effective
- sort=score_desc
Search exploits by source, language, author, GitHub stars, or LLM classification
Get full CVE intelligence briefs with ranked exploits and trojan warnings
Find all exploits for a specific CVE, vendor, or product
Resolve alternate IDs (EDB-XXXXX, GHSA-XXXXX) to their CVE
Discover exact product names for any vendor (CPE product name lookup)
Look up exploit authors and their work
Browse CWE categories and vendor threat landscapes
Audit a tech stack for exploitable vulnerabilities
Generate pentest report findings from real CVE data (all sections present with N/A when data is absent)
Retrieve exploit source code for analysis
See MITRE ATT&CK techniques and deception indicators for trojans

Related MCP server: eip-mcp

Tools (17)

Tool	Description
`search_vulnerabilities`	Search CVEs with full-text `query` and filters: severity, vendor, product, ecosystem, CWE, CVSS/EPSS thresholds, KEV, Nuclei, year, date range. Supports explicit score mode via `score_version` + `min_score` + `sort=score_desc`. Start here for product research.
`get_vulnerability`	Full intelligence brief for a CVE or EIP-ID. Includes ranked exploits (AI analysis, MITRE techniques, source URLs), products, Nuclei templates (with description/impact/remediation), references.
`search_exploits`	Browse exploits with structured filters only (no free-text query): source, language, LLM classification, author, stars, CVE, vendor, product, attack_type, complexity, reliability, requires_auth.
`get_exploit_code`	Retrieve exploit source code by platform ID (auto-selects main file)
`get_exploit_analysis`	Full AI analysis for a single exploit: classification, attack type, complexity, reliability, MITRE ATT&CK, summary, and trojan/deception indicators
`get_nuclei_templates`	Nuclei scanner templates with description, impact, remediation, and Shodan/FOFA/Google dork queries
`list_authors`	Top exploit researchers ranked by exploit count
`get_author`	Author profile with all their exploits and CVE context
`list_cwes`	CWE categories ranked by vulnerability count
`get_cwe`	CWE detail with description, exploit likelihood, parent hierarchy
`list_vendors`	Software vendors ranked by vulnerability count
`list_products`	Discover exact product names for a vendor (CPE name lookup with vuln counts)
`lookup_alt_id`	Resolve alternate IDs (EDB-XXXXX, GHSA-XXXXX) to their CVE
`audit_stack`	Audit a tech stack for critical/high severity CVEs with exploits, sorted by EPSS risk
`generate_finding`	Generate a Markdown pentest report finding — all sections present with N/A when data is absent
`get_platform_stats`	Platform-wide counts and data freshness
`check_health`	API health and ingestion source timestamps

Prompts (6)

Built-in MCP prompts are also exported for clients that support prompts/skills:

Prompt	Description
`investigate-cve`	Deep-dive workflow for a specific CVE or EIP-ID
`audit-stack`	Prioritized stack audit workflow for up to 5 technologies
`pentest-finding`	Pentest finding workflow with optional target and notes
`threat-landscape`	Vendor/product threat landscape workflow
`exploit-analysis`	Safety-first exploit review workflow
`trending-threats`	Recent threat briefing focused on KEV, ransomware, or in-the-wild exploitation

Installation

Requirements

Python 3.10 or newer (check with python3 --version or python --version)
pip (comes with Python on most systems)
An MCP-compatible AI client (Cursor IDE, Claude Desktop, etc.)

Base installation is enough for stdio clients. If you want to run the standalone Streamable HTTP server, install the optional HTTP extra:

pip install "eip-mcp[http]"
# or
pipx install 'eip-mcp[http]'

macOS

# Install Python 3 via Homebrew if needed
brew install python3

# Recommended: pipx (isolated install, eip-mcp command available globally)
brew install pipx
pipx install eip-mcp

# Alternative: virtual environment
python3 -m venv ~/.venvs/eip-mcp
source ~/.venvs/eip-mcp/bin/activate
pip install eip-mcp

Kali Linux / Debian / Ubuntu

# Option 1: Native APT repo (recommended on Kali/Debian/Ubuntu)
curl -fsSL https://repo.exploit-intel.com/setup.sh | sudo bash
sudo apt install -y eip-mcp

# Option 2: pipx (isolated install, eip-mcp command available globally)
sudo apt install -y pipx
pipx install eip-mcp

# Option 3: virtual environment
sudo apt update && sudo apt install -y python3-pip python3-venv
python3 -m venv ~/.venvs/eip-mcp
source ~/.venvs/eip-mcp/bin/activate
pip install eip-mcp

Kali users: If you see error: externally-managed-environment, use APT, pipx, or a virtual environment. Kali 2024+ enforces PEP 668 and blocks global pip installs.

Windows

# Install Python 3 from https://python.org (check "Add to PATH" during install)

# Option 1: pipx
pip install pipx
pipx install eip-mcp

# Option 2: virtual environment
python -m venv %USERPROFILE%\.venvs\eip-mcp
%USERPROFILE%\.venvs\eip-mcp\Scripts\activate
pip install eip-mcp

Arch Linux / Manjaro

sudo pacman -S python python-pip python-pipx
pipx install eip-mcp

From Source (all platforms)

git clone https://github.com/exploitintel/eip-mcp.git
cd eip-mcp
python3 -m venv .venv
source .venv/bin/activate      # Linux/macOS
# .venv\Scripts\activate       # Windows
pip install -e .

# Optional: include HTTP transport dependencies
pip install -e '.[http]'

Running the Server Directly

stdio (default)

eip-mcp

Streamable HTTP

Install the HTTP extra first, then run:

eip-mcp --transport streamable-http

Useful flags:

--host 127.0.0.1 and --port 8080 control the bind address
--stateless disables session tracking. Recommended for any HTTP deployment of eip-mcp: every tool is a read-only call, the server doesn't use server-initiated notifications, and stateless mode means a service restart no longer drops live client sessions (in stateful mode, restart causes connected clients to hit 404 "Session not found" until they re-initialize). The hosted endpoint at https://mcp.exploit-intel.com/mcp runs with --stateless for this reason.

Equivalent environment variables:

EIP_MCP_TRANSPORT
EIP_MCP_HOST
EIP_MCP_PORT
EIP_MCP_STATELESS
EIP_API_KEY to forward an optional X-API-Key header for custom deployments that expect it

If you bind HTTP to 0.0.0.0 or ::, set EIP_MCP_ALLOWED_HOSTS to the hostname or IP your clients will use. For browser-based access, also set EIP_MCP_ALLOWED_ORIGINS.

Connecting to Your AI Client

Cursor IDE

Add to .cursor/mcp.json in your workspace (or globally at ~/.cursor/mcp.json):

If installed with pipx (recommended):

{
  "mcpServers": {
    "eip": {
      "command": "eip-mcp",
      "args": [],
      "env": {}
    }
  }
}

If installed in a virtual environment:

{
  "mcpServers": {
    "eip": {
      "command": "/absolute/path/to/.venvs/eip-mcp/bin/eip-mcp",
      "args": [],
      "env": {}
    }
  }
}

Note: When using a virtual environment, use the absolute path to the eip-mcp binary inside it. On macOS/Linux: ~/.venvs/eip-mcp/bin/eip-mcp. On Windows: %USERPROFILE%\.venvs\eip-mcp\Scripts\eip-mcp.exe.

Claude Desktop

macOS — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "eip": {
      "command": "eip-mcp",
      "args": [],
      "env": {}
    }
  }
}

Windows — add to %APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "eip": {
      "command": "eip-mcp",
      "args": [],
      "env": {}
    }
  }
}

If your AI client can't find eip-mcp, use the full path to the binary (see virtual environment note above).

Verify

After restarting your AI client, you should see 17 tools available. In clients that surface prompts, you should also see 6 prompts. Try asking:

"Show me all trojan exploits"

Troubleshooting

Problem	Solution
MCP server not showing up	If using a venv, use the full absolute path to the `eip-mcp` binary
`command not found: eip-mcp`	Make sure your venv is activated, or use `pipx` which manages PATH automatically
`externally-managed-environment`	Use `pipx` or a virtual environment (see install instructions above)
`Streamable HTTP transport requires additional packages`	Install the optional HTTP dependencies with `pip install "eip-mcp[http]"` or `pip install -e '.[http]'`
Connection timeout errors	Check that you can reach `https://exploit-intel.com` from your machine
0 tools showing	Restart Cursor/Claude Desktop after editing the MCP config

Demo

asciicast

What Questions Can You Ask?

Below are representative example prompts with sample output from the live platform. Exact counts and rankings will change over time.

"Show me all the backdoored/trojan exploits"

Uses search_exploits with llm_classification=trojan:

Found 38 exploits (page 1/13):

      ★0  nomisec      vatslaaeytoygag/CVE-2025-59287
         CVE-2025-59287  CRITICAL  CVSS:9.8  [] trojan
         AI: other | moderate | theoretical
         !! Obfuscated hex strings in `encrypt.py`
         !! Subprocess calls to execute remote payloads

          writeup      exploit-116218
         CVE-2026-2641  LOW  CVSS:3.3  [] trojan
         AI: other | complex | theoretical
         !! obfuscated garbage characters
         !! no functional exploit logic

38 exploits flagged as trojans by AI analysis. Each shows deception indicators explaining exactly how the trojan deceives users.

"Find all reliable RCE exploits"

Uses search_exploits with attack_type=RCE, reliability=reliable, sort=stars_desc:

Found 24,204 exploits (page 1/4841):

   ★4275  nomisec      zhzyker/exphub
         CVE-2020-14882  CRITICAL  CVSS:9.8  [] working_poc
         AI: RCE | moderate | reliable

   ★3436  nomisec      fullhunt/log4j-scan
         CVE-2021-44228  CRITICAL  CVSS:10.0  [] scanner
         AI: RCE | moderate | reliable

   ★1848  nomisec      kozmer/log4j-shell-poc
         CVE-2021-44228  CRITICAL  CVSS:10.0  [] working_poc
         AI: RCE | moderate | reliable

   ★1835  github       neex/phuip-fpizdam
         CVE-2019-11043  HIGH  CVSS:8.7  [] working_poc
         AI: RCE | moderate | reliable

24,204 reliable RCE exploits. Filter further with complexity=trivial for easy wins or requires_auth=false for unauthenticated attacks.

"Show me trivial SQL injection exploits that don't require auth"

Uses search_exploits with attack_type=SQLi, complexity=trivial, requires_auth=false:

Found 6,979 exploits (page 1/1396):

      ★0  github       pwnpwnpur1n/CVE-2024-22983
         CVE-2024-22983  HIGH  CVSS:8.1  [php] writeup
         AI: SQLi | trivial | reliable

      ★0  github       security-n/CVE-2021-39379
         CVE-2021-39379  CRITICAL  CVSS:9.8  [] writeup
         AI: SQLi | trivial | reliable
      ...

"Give me all exploits for CVE-2024-3400"

Uses search_exploits with cve=CVE-2024-3400, sort=stars_desc:

Found 43 exploits (page 1/9):

    ★161  github       h4x0r-dz/CVE-2024-3400
         CVE-2024-3400  CRITICAL  CVSS:10.0  [http] working_poc

     ★90  github       W01fh4cker/CVE-2024-3400-RCE-Scan
         CVE-2024-3400  CRITICAL  CVSS:10.0  [python] working_poc

     ★72  github       0x0d3ad/CVE-2024-3400
         CVE-2024-3400  CRITICAL  CVSS:10.0  [python] working_poc

     ★30  github       ihebski/CVE-2024-3400
         CVE-2024-3400  CRITICAL  CVSS:10.0  [http/network] working_poc

     ★14  github       Chocapikk/CVE-2024-3400
         CVE-2024-3400  CRITICAL  CVSS:10.0  [python] working_poc

43 exploits, ranked by GitHub stars, with LLM quality classification.

"How many Mitel exploits are there?"

Uses search_exploits with vendor=mitel, has_code=true:

Found 100 exploits (page 1/34):

          exploitdb    EDB-46666
         CVE-2019-9591  MEDIUM  CVSS:6.1  []

          exploitdb    EDB-32745
         CVE-2014-0160  HIGH  CVSS:7.5  [python]

      ★0  github       lu4m575/CVE-2024-35286_scan.nse
         CVE-2024-35286  CRITICAL  CVSS:9.8  []

      ★17  github       Chocapikk/CVE-2024-41713
         CVE-2024-41713  CRITICAL  CVSS:9.1  [python] working_poc
      ...

100 Mitel exploits with downloadable code, across all affected CVEs.

"Who are the top exploit authors?"

Uses list_authors:

Exploit Authors (40,931 total):

  Metasploit                      1875 exploits
  Google Security Research        1214 exploits
  Ihsan Sencan                     970 exploits
  LiquidWorm                       780 exploits
  Gjoko 'LiquidWorm' Krstic        674 exploits

"Show me all exploits by Chocapikk"

Uses get_author with author_name=Chocapikk:

Author: Chocapikk
Exploits: 91  |  Active since: 2017-04-25

Exploits:
    ★244  CVE-2026-21858  Chocapikk/CVE-2026-21858  working_poc
    ★235  CVE-2023-29357  Chocapikk/CVE-2023-29357  working_poc
    ★179  CVE-2024-25600  Chocapikk/CVE-2024-25600  working_poc
    ★148  CVE-2023-22515  Chocapikk/CVE-2023-22515  working_poc
    ★134  CVE-2024-45519  Chocapikk/CVE-2024-45519  working_poc
     ★99  CVE-2024-3273  Chocapikk/CVE-2024-3273  working_poc
      ...

91 exploits by Chocapikk, ranked by GitHub stars, all classified as working PoCs.

"What are the most common vulnerability types?"

Uses list_cwes:

CWE Categories (200 with vulnerabilities):

    CWE-79   41774 vulns  XSS
    CWE-89   17788 vulns  SQL Injection
   CWE-787   13374 vulns  Out-of-Bounds Write
   CWE-119   13344 vulns  Memory Corruption
    CWE-20   11770 vulns  Improper Input Validation
   CWE-200    9555 vulns  Information Disclosure
   CWE-352    8710 vulns  CSRF
   CWE-125    8163 vulns  Out-of-Bounds Read
    CWE-22    8141 vulns  Path Traversal
   CWE-862    6683 vulns  Missing Authorization
      ...

"Tell me about SQL Injection (CWE-89)"

Uses get_cwe with cwe_id=CWE-89:

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Short label: SQL Injection
Exploit likelihood: High
Vulnerabilities: 17,788
Parent: CWE-943 (Improper Neutralization of Special Elements in Data Query Logic)

Description:
The product constructs all or part of an SQL command using externally-influenced
input from an upstream component, but it does not neutralize or incorrectly
neutralizes special elements that could modify the intended SQL command when it
is sent to a downstream component...

"Which vendors have the most vulnerabilities?"

Uses list_vendors:

Top Vendors (200 total):

  microsoft                       13697 vulns
  google                          12451 vulns
  linux                           12096 vulns
  oracle                          10107 vulns
  debian                          10072 vulns
  apple                            8426 vulns
  ibm                              7981 vulns
  adobe                            6960 vulns
  cisco                            6526 vulns
  redhat                           5505 vulns
      ...

"What critical Fortinet vulns are being actively exploited?"

Uses search_vulnerabilities with vendor=fortinet, severity=critical, is_kev=true, sort=epss_desc:

Found 16 vulnerabilities (page 1/6):

  CVE-2018-13379  CRITICAL  CVSS:9.1  EPSS:94.5%  Exploits:14 [KEV] [NUCLEI]
    Fortinet Fortiproxy < 1.2.9 - Path Traversal

  CVE-2022-40684  CRITICAL  CVSS:9.8  EPSS:94.4%  Exploits:31 [KEV] [NUCLEI]
    Fortinet Fortiproxy < 7.0.7 - Authentication Bypass

  CVE-2024-55591  CRITICAL  CVSS:9.8  EPSS:94.2%  Exploits:9 [KEV] [NUCLEI]
    Fortinet Fortiproxy < 7.0.20 - Authentication Bypass

"Tell me about CVE-2019-0708 (BlueKeep)"

Uses get_vulnerability with cve_id=CVE-2019-0708:

============================================================
CVE-2019-0708  [CRITICAL]  [KEV]
============================================================
Title: BlueKeep RDP Remote Windows Kernel Use After Free

CVSS: 9.8  EPSS: 94.5% (100.0th percentile)
Attack Vector: NETWORK | CWE: CWE-416 | Published: 2019-05-16 | KEV Added: 2021-11-03

EXPLOITS (127 total):
  METASPLOIT MODULES:
    - cve_2019_0708_bluekeep_rce.rb  [ruby]  Rank: manual
      AI: RCE | complexity:complex | reliability:racy | target:Microsoft Windows 7 SP1
      MITRE: T1059 - Command and Scripting Interpreter, T1068 - Exploitation for Privilege Escalation
  VERIFIED (ExploitDB):
    - EDB-47416  [ruby]  verified
      AI: RCE | complexity:complex | reliability:racy | target:Microsoft Windows RDP (7 SP1 / 2008 R2)
      MITRE: T1068, T1210 - Exploitation of Remote Services
  PROOF OF CONCEPT:
    - ★1187  nomisec  Ekultek/BlueKeep  working_poc
      AI: RCE | complexity:moderate | reliability:reliable | target:Windows RDP
      MITRE: T1189 - Drive-by Compromise, T1068
    - ★914   nomisec  robertdavidgraham/rdpscan  scanner
      AI: info_leak | complexity:moderate | reliability:reliable
      MITRE: T1046 - Network Service Scanning
      ...and 113 more PoCs
  *** SUSPICIOUS / TROJAN ***:
    - WARNING: ttsite/CVE-2019-0708-  [TROJAN] — flagged by AI analysis
      Summary: The repository is a scam and does not contain any exploit code.
      Deception indicators:
        - False claims about exploit availability
        - Deceptive contact information
        - No actual exploit code or technical details

Every exploit now shows AI analysis: attack type, complexity, reliability, target software, and MITRE ATT&CK techniques. Trojans show deception indicators explaining exactly how they deceive users.

"Audit our stack: nginx, postgresql, redis"

Uses audit_stack with technologies=nginx, postgresql, redis:

STACK AUDIT RESULTS
========================================

--- NGINX (66 exploitable CVEs) ---
  CVE-2023-44487  HIGH  CVSS:7.5  EPSS:94.4%  Exploits:22 [KEV]
    HTTP/2 Rapid Reset DoS
  CVE-2013-2028  CVSS:--  EPSS:92.8%  Exploits:25
    Nginx < 1.4.0 - Out-of-Bounds Write
  CVE-2017-7529  HIGH  CVSS:7.5  EPSS:91.9%  Exploits:54
    Nginx <1.14 - Info Disclosure
      ...and 56 more

--- POSTGRESQL (56 exploitable CVEs) ---
  CVE-2019-9193  HIGH  CVSS:7.2  EPSS:93.4%  Exploits:41
    PostgreSQL < 11.2 - OS Command Injection
  CVE-2018-1058  HIGH  CVSS:8.8  EPSS:82.7%  Exploits:13
    PostgreSQL < 9.3.22 - Improper Input Validation
      ...and 46 more

--- REDIS (39 exploitable CVEs) ---
  CVE-2022-0543  CRITICAL  CVSS:10.0  EPSS:94.4%  Exploits:32 [KEV]
    Redis Lua Sandbox Escape
  CVE-2018-11218  CRITICAL  CVSS:9.8  EPSS:80.3%  Exploits:3
    Redis < 3.2.12 - Out-of-Bounds Write
      ...and 29 more

Total: 30 findings shown across 3 technologies

"Get me the Nuclei dorks for TeamCity"

Uses get_nuclei_templates with cve_id=CVE-2024-27198:

NUCLEI TEMPLATES (1):
  Template: CVE-2024-27198  [critical] [verified]
  Name: TeamCity < 2023.11.4 - Authentication Bypass
  Author: DhiyaneshDk
  Tags: cve, cve2024, teamcity, jetbrains, auth-bypass, kev

  Recon Queries:
    Shodan:  http.component:"TeamCity" || http.title:teamcity
    FOFA:    title=teamcity
    Google:  intitle:teamcity

  Run: nuclei -t CVE-2024-27198 -u https://target.com

"Write a pentest finding for CVE-2024-3400"

Uses generate_finding with cve_id=CVE-2024-3400, target=fw.corp.example.com, notes=Confirmed RCE via GlobalProtect:

# CVE-2024-3400: Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution

**Severity:** CRITICAL
**CVSS v3 Score:** 10.0  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
**EPSS Score:** 94.3% probability of exploitation
**Exploited in the Wild:** Yes (CISA KEV) (VulnCheck KEV) (InTheWild.io) — **ransomware campaigns confirmed**
**CWE:** CWE-77, CWE-20

**Affected Target:** fw.corp.example.com

## Description
A command injection vulnerability in the GlobalProtect feature of PAN-OS...

## Exploit Availability (43 public exploits)
- **Metasploit:** panos_telemetry_cmd_exec.rb  (rank: excellent)

## References
- https://security.paloaltonetworks.com/CVE-2024-3400

## Tester Notes
Confirmed RCE via GlobalProtect

"List all Metasploit modules"

Uses search_exploits with source=metasploit:

Found 2,993 exploits (page 1/599):

          metasploit   modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
         CVE-2024-12356  CRITICAL  CVSS:9.8  [ruby] working_poc
         AI: RCE | moderate | reliable

          metasploit   modules/exploits/multi/http/log4shell_header_injection.rb
         CVE-2021-44228  CRITICAL  CVSS:10.0  [ruby] working_poc
         AI: RCE | moderate | reliable
      ...

~3,000 Metasploit modules indexed.

Architecture

Tools (17)

Tool	Description
`search_vulnerabilities`	Search CVEs with full-text `query` and filters: severity, vendor, product, ecosystem, CWE, CVSS/EPSS thresholds, KEV, Nuclei, year, date range. Start here for product research.
`get_vulnerability`	Full intelligence brief for a CVE or EIP-ID. Includes ranked exploits (AI analysis, MITRE techniques, source URLs), products, Nuclei templates (with description/impact/remediation), references.
`search_exploits`	Browse exploits with structured filters only (no free-text query): source, language, LLM classification, author, stars, CVE, vendor, product, attack_type, complexity, reliability, requires_auth.
`get_exploit_code`	Retrieve exploit source code by platform ID (auto-selects main file)
`get_exploit_analysis`	Full AI analysis for a single exploit: classification, attack type, complexity, reliability, MITRE ATT&CK, summary, and trojan/deception indicators
`get_nuclei_templates`	Nuclei scanner templates with description, impact, remediation, and Shodan/FOFA/Google dork queries
`list_authors`	Top exploit researchers ranked by exploit count
`get_author`	Author profile with all their exploits and CVE context
`list_cwes`	CWE categories ranked by vulnerability count
`get_cwe`	CWE detail with description, exploit likelihood, parent hierarchy
`list_vendors`	Software vendors ranked by vulnerability count
`list_products`	Discover exact product names for a vendor (CPE name lookup with vuln counts)
`lookup_alt_id`	Resolve alternate IDs (EDB-XXXXX, GHSA-XXXXX) to their CVE
`audit_stack`	Audit a tech stack for critical/high severity CVEs with exploits, sorted by EPSS risk
`generate_finding`	Generate a Markdown pentest report finding — all sections present with N/A when data is absent
`get_platform_stats`	Platform-wide counts and data freshness
`check_health`	API health and ingestion source timestamps

Security Model

This MCP server runs locally and proxies requests to the public EIP API over HTTPS.

Input Validation

Every parameter passes through strict validation:

CVE/EIP IDs: Regex ^(CVE|EIP)-\d{4}-\d{4,7}$
Exploit IDs: Positive integers, capped at 2^31
Strings: Max 200 chars, null bytes rejected, control characters stripped
Numerics: CVSS 0-10, EPSS 0-1, per_page 1-25
Enums: Severity, sort, ecosystem validated against allowlists
File paths: .., absolute paths, null bytes all blocked
Technology names: Alphanumeric + dots/hyphens/spaces, max 5 items

Response Safety

Exploit code capped at 50KB
All responses are plain text (no executable content)
Error messages are generic (no internal API leakage)
Trojan exploits are explicitly flagged

Network Safety

API base URL hardcoded to https://exploit-intel.com
TLS verification enabled
30-second timeout on all calls
Optional X-API-Key header forwarding via EIP_API_KEY for custom deployments; the public EIP API does not require it

Dependencies

mcp>=1.23.0 — Official MCP Python SDK
httpx>=0.27.0 — HTTP client
Python 3.10+

Testing

Run the default regression suite:

PYTHONPATH=. pytest tests

Live MCP integration tests are opt-in under pytest. Start the HTTP transport first:

eip-mcp --transport streamable-http --port 8080

Then run:

PYTHONPATH=. pytest tests/test_mcp_tools.py --base-url http://127.0.0.1:8080/mcp/

The script entrypoints still work if you prefer them:

python3 tests/test_mcp_tools.py --base-url http://127.0.0.1:8080/mcp/
python3 tests/test_mcp_timing.py --base-url http://127.0.0.1:8080/mcp/

Deploy

Optional `X-API-Key` Forwarding

The public EIP API does not require an API key. If you are routing through your own frontend or deployment that expects X-API-Key, eip-mcp will forward EIP_API_KEY when it is set:

{
  "mcpServers": {
    "eip": {
      "command": "eip-mcp",
      "args": [],
      "env": {
        "EIP_API_KEY": "your-key-here"
      }
    }
  }
}

If EIP_API_KEY is unset, requests are still sent normally to the public API. Public rate limiting is currently documented as 60 requests/minute.

Distribution

PyPI — pip install eip-mcp / pipx install eip-mcp
APT repo — repo.exploit-intel.com (Kali/Debian/Ubuntu native packages)
Remote MCP — https://mcp.exploit-intel.com/mcp (Streamable HTTP, runs --stateless; no local install needed)

Git Workflow

Never push directly to main. All changes go through a branch and PR.

git checkout -b <branch-name>
# make changes
git push origin <branch-name>
gh pr create

PRs require review before merge.

License

MIT

MCP Badge

Available Tools

17 tools

audit_stackA

Read-onlyIdempotent

Audit a technology stack for exploitable vulnerabilities. Accepts a comma-separated list of technologies (max 5) and searches for critical/ high severity CVEs with public exploits for each one, sorted by EPSS exploitation probability. Use this when a user describes their infrastructure and wants to know what to patch first. Example: technologies='nginx, postgresql, node.js' returns a risk-sorted list of exploitable CVEs grouped by technology. Rate-limit cost: each technology requires up to 2 API calls; 5 technologies counts as up to 10 calls toward your rate limit.

Inputs: technologies (required).

check_healthA

Read-onlyIdempotent

Check the EIP API health and data freshness. Returns database status and timestamps for each of the 10 ingestion sources (NVD, KEV, EPSS, ExploitDB, GitHub, Metasploit, etc.).

Inputs: no named parameters.

generate_findingA

Read-onlyIdempotent

Generate a pentest report finding in Markdown format for a specific vulnerability. Fetches full detail and formats it as a professional finding with severity, CVSS, description, affected products, exploit availability, and references. Accepts both CVE-IDs and EIP-IDs. Optionally include the target system tested and tester notes. The output is ready to paste into a pentest report. Example: cve_id='CVE-2024-3400', target='fw.corp.example.com', notes='Confirmed RCE via GlobalProtect gateway'.

Inputs: cve_id (required), target, notes.

get_authorA

Read-onlyIdempotent

Get an exploit author's profile with all their exploits. Returns author name, handle, total exploit count, activity start date, and a paginated list of their exploits with CVE context. Use this when asked about a specific researcher like 'show me all exploits by Chocapikk'.

Inputs: author_name (required).

get_cweA

Read-onlyIdempotent

Get details for a specific CWE including full name, description, exploit likelihood, parent CWE, and total vulnerability count. Example: cwe_id='CWE-79' returns details about Cross-Site Scripting.

Inputs: cwe_id (required).

get_exploit_analysisA

Read-onlyIdempotent

Get the full AI analysis for a single exploit by its platform ID. Returns classification (working_poc, trojan, suspicious, scanner, stub, writeup), attack type, complexity, reliability, confidence score, authentication requirements, target software, a summary of what the exploit does, prerequisites, MITRE ATT&CK techniques, deception indicators for trojans, and the standalone backdoor-review verdict with operator-risk notes when available. Use this to check if an exploit is safe before reviewing its code. Example: exploit_id=61514 returns a TROJAN warning with deception indicators.

Inputs: exploit_id (required).

get_exploit_codeA

Read-onlyIdempotent

Retrieve the source code of a specific exploit by its platform ID. IMPORTANT: Use the platform's internal ID shown as [id=XXXXX] in results, NOT the ExploitDB number (EDB-XXXXX). These are different numbering systems. Returns code from the exploit archive. If no file_path is specified, auto-selects the most relevant code file. Use this to analyze exploit mechanics, understand attack techniques, or review PoC code.

Inputs: exploit_id (required), file_path.

get_nuclei_templatesA

Read-onlyIdempotent

Get Nuclei scanner templates and recon dorks for a vulnerability. Returns template metadata, severity, verification status, tags, and ready-to-use Shodan, FOFA, and Google dork queries for target identification. Accepts both CVE-IDs and EIP-IDs. Use this to plan scanning or reconnaissance.

Inputs: cve_id (required).

get_platform_statsA

Read-onlyIdempotent

Get platform-wide statistics from the Exploit Intelligence Platform. Returns total counts of vulnerabilities, exploits, KEV entries, Nuclei templates, vendors, and authors, plus the last data update timestamp.

Inputs: no named parameters.

get_vulnerabilityA

Read-onlyIdempotent

Get a full intelligence brief for a specific vulnerability. Accepts both CVE-IDs (e.g. CVE-2024-3400) and EIP-IDs (e.g. EIP-2026-12345 for pre-CVE entries). Returns detailed information including CVSS score and vector, EPSS exploitation probability, CISA KEV status, description, affected products, ranked exploits (grouped by Metasploit modules, verified ExploitDB, GitHub PoCs, and trojans), Nuclei scanner templates with recon dorks, alternate identifiers, and references. Exploits are ranked by quality: Metasploit modules first (peer-reviewed), then verified ExploitDB, then GitHub by stars. Trojans are flagged at the bottom.

Inputs: cve_id (required).

list_authorsA

Read-onlyIdempotent

List exploit authors/researchers ranked by exploit count. Returns the top security researchers with their exploit counts and handles. Use this when asked 'who are the top exploit authors?' or 'who writes the most exploits?'

Inputs: page, per_page.

list_cwesA

Read-onlyIdempotent

List CWE (Common Weakness Enumeration) categories ranked by vulnerability count. Returns CWE IDs, names, short labels, exploit likelihood, and how many CVEs have that weakness. Use this when asked 'what are the most common vulnerability types?'

Inputs: no named parameters.

list_productsA

Read-onlyIdempotent

List products for a specific vendor with vulnerability counts. Use this to discover exact product names for filtering. Product names in the database use CPE conventions (e.g. 'exchange_server' not 'exchange', 'windows_10' not 'windows 10'). Example: vendor='microsoft' returns products like exchange_server, windows_10, office, edge_chromium.

Inputs: vendor (required).

list_vendorsA

Read-onlyIdempotent

List software vendors ranked by vulnerability count. Returns the top 200 vendors with their total CVE counts. Use this when asked 'which vendors have the most vulnerabilities?' or to understand the threat landscape by vendor.

Inputs: no named parameters.

lookup_alt_idA

Read-onlyIdempotent

Look up a vulnerability by an alternate identifier such as an ExploitDB ID (EDB-XXXXX) or GitHub Security Advisory ID (GHSA-XXXXX). Returns the matching CVE-ID with basic severity info. Use this when you have an EDB number or GHSA ID and need to find the corresponding CVE.

Inputs: alt_id (required).

search_exploitsA

Read-onlyIdempotent

Browse and filter exploits using STRUCTURED FILTERS ONLY (no free-text query). Use this to filter by source (github, metasploit, exploitdb, nomisec, gitlab, inthewild, vulncheck_xdb, patchapalooza), language (python, ruby, etc.), LLM classification (working_poc, trojan, suspicious, scanner, stub, writeup, tool, no_code), author, min stars, code availability, CVE ID, vendor, or product. Also filter by AI analysis: attack_type (RCE, SQLi, XSS, DoS, LPE, auth_bypass, info_leak), complexity (trivial/simple/moderate/complex), reliability (reliable/unreliable/untested/theoretical), requires_auth. NOTE: To search by product name (e.g. 'OpenSSH', 'Apache'), use search_vulnerabilities instead — it has free-text query and get_vulnerability already includes exploits in the response. Examples: source='metasploit' for all Metasploit modules; attack_type='RCE' with reliability='reliable' for weaponizable RCE exploits; cve='CVE-2024-3400' for all exploits targeting a specific CVE; vendor='mitel' for all Mitel exploits.

Inputs: source, language, llm_classification, attack_type, +12 more.

search_vulnerabilitiesA

Read-onlyIdempotent

Search the Exploit Intelligence Platform for vulnerabilities (CVEs). Returns a list of matching CVEs with CVSS scores, EPSS exploitation probability, exploit counts, CISA KEV status, VulnCheck KEV, InTheWild.io exploitation signals, and ransomware attribution. Supports full-text search, severity/vendor/product/ecosystem/CWE filters, CVSS/EPSS thresholds, plus any_exploited and ransomware filters. When sort is omitted, the API may automatically prefer newest exploitation, exploit, or nuclei-template activity based on the filters you set. Examples: query='apache httpd' with has_exploits=true; vendor='fortinet' with severity='critical' and is_kev=true sorted by epss_desc; any_exploited=true with ransomware=true for ransomware-linked CVEs; cwe='89' with min_cvss=9 for critical SQL injection CVEs.

Inputs: query, severity, has_exploits, is_kev, +17 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.4/5.0

Scored 2026-05-19 03:20 across 17 tools

Disambiguation5/5

Each tool has a distinct purpose, from searching vulnerabilities and exploits to retrieving author profiles and generating reports. The overlap between search_exploits and search_vulnerabilities is clarified by their different filtering capabilities.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern (e.g., get_vulnerability, list_authors, search_exploits). A few like audit_stack and check_health differ but still adhere to the same style.

Tool Count5/5

With 17 tools, the server provides a thorough coverage of exploit intelligence workflows without being overwhelming. The number is well-scoped for the domain.

Completeness5/5

The tool set covers core operations: searching, detailed retrieval, listing, health checks, and report generation. There are no obvious gaps for an intelligence platform of this nature.

Resources

Related MCP Connectors

Exploit Intelligence Platform — CVE, Vulnerability and Exploit DatabaseA
com.exploit-intel
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
Security Penetration Testing Monitoring
2
https://mcp.exploit-intel.com/mcp
Cybersecurity Vulnerability Intel
io.github.martc03
CVE lookup via NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK. 7 tools.
Security Search Monitoring
26
https://cybersecurity-vuln-mcp.apify.actor/mcp
nist-nvd-mcp-serverA
io.github.cyanheads
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
Penetration Testing Government Data
512
https://nist-nvd.caseyjhand.com/mcp
Security Intel MCPA
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp

Related MCP Servers

Risky Business MCP Server
Security Penetration Testing Databases
khizar-anjum
F
license
Not graded
quality
D
maintenance
Enables comprehensive cybersecurity vulnerability assessment by searching GitHub repositories for exploits, querying NIST NVD for CVE details, and accessing CISA's Known Exploited Vulnerabilities catalog. Supports complete vulnerability research workflows from threat intelligence gathering to proof-of-concept discovery.
Updated a year ago (2025-08-17 19:52 UTC)
4
-
eip-mcp
Penetration Testing Security
exploitintel
A
license
A
quality
C
maintenance
Gives AI assistants access to the Exploit Intelligence Platform for vulnerability and exploit intelligence. Supports searching CVEs, exploits, and generating pentest findings.
Updated 16 days ago (2026-10-29 06:27 UTC)
17
53 PyPI
1
MIT
cve-lookup-mcp
Security Open Data
Aashish-32
A
license
A
quality
D
maintenance
Provides live CVE data from NVD and EPSS without API key, enabling AI assistants to look up CVSS scores, search vulnerabilities, and check product CVEs.
Updated 5 months ago (2026-06-21 11:17 UTC)
3
MIT
vuln-intel-mcp
Security Penetration Testing
rohanrajnist
A
license
Not graded
quality
D
maintenance
Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
Updated 4 months ago (2026-07-06 06:18 UTC)
1
MIT

Exploit Intel Platform MCP Server

Overview

Highlights

What This Enables

Tools (17)

Prompts (6)

Installation

Requirements

macOS

Kali Linux / Debian / Ubuntu

Windows

Arch Linux / Manjaro

From Source (all platforms)

Running the Server Directly

stdio (default)

Streamable HTTP

Connecting to Your AI Client

Cursor IDE

Claude Desktop

Verify

Troubleshooting

Demo

What Questions Can You Ask?

"Show me all the backdoored/trojan exploits"

"Find all reliable RCE exploits"

"Show me trivial SQL injection exploits that don't require auth"

"Give me all exploits for CVE-2024-3400"

"How many Mitel exploits are there?"

"Who are the top exploit authors?"

"Show me all exploits by Chocapikk"

"What are the most common vulnerability types?"

"Tell me about SQL Injection (CWE-89)"

"Which vendors have the most vulnerabilities?"

"What critical Fortinet vulns are being actively exploited?"

"Tell me about CVE-2019-0708 (BlueKeep)"

"Audit our stack: nginx, postgresql, redis"

"Get me the Nuclei dorks for TeamCity"

"Write a pentest finding for CVE-2024-3400"

"List all Metasploit modules"

Architecture

Tools (17)

Security Model

Input Validation

Response Safety

Network Safety

Dependencies

Testing

Deploy

Optional X-API-Key Forwarding

Distribution

Git Workflow

License

Available Tools

Tool Schema Changelog

TDQS

Resources

Related MCP Connectors

Related MCP Servers

Risky Business MCP Server

eip-mcp

cve-lookup-mcp

vuln-intel-mcp

Optional `X-API-Key` Forwarding