Kitsune vulnerability research MCP

This local MCP server keeps vulnerability intelligence, research scope, scanner results, evidence receipts, Bugcrowd VRT assessments, and report drafts in one SQLite ledger.

It is built for authorized defensive research. It does not scan targets, execute exploits, run shell commands, submit reports, or publish disclosures.

Data sources

The server uses fixed adapters. A caller cannot supply another origin.

CVE.org is the canonical record. NVD is enrichment and recent-record discovery. KEV and EPSS are separate signals. VRT is a technical baseline, not authorization or a guaranteed bounty rating.

Related MCP server: MoonMCP

Requirements

• Node.js 24 or newer

• npm 10 or newer

• An absolute import root if SARIF or evidence files will be imported

No API key is required for the public feeds. NVD_API_KEY is optional and is sent only to NVD.

Install and verify

npm install
npm test
npm run check
npm run lint
npm run build

The source is available under the MIT license. The package is not published to npm.

MCP client configuration

Build first, then point the client at the compiled stdio entry point:

{
  "mcpServers": {
    "kitsune-vuln-research": {
      "command": "node",
      "args": [
        "--disable-warning=ExperimentalWarning",
        "C:\\path\\to\\kitsune-vuln-research-mcp\\dist\\index.js"
      ],
      "env": {
        "VULN_IMPORT_ROOTS": "C:\\absolute\\path\\to\\scanner-output",
        "VULN_LOG_LEVEL": "warn"
      }
    }
  }
}

License

MIT. See LICENSE.

The built-in Node SQLite module still carries an ExperimentalWarning in Node 24. The narrow command-line flag keeps that warning out of MCP stderr without suppressing other warning classes.

Configuration

Runtime state is kept under VULN_DATA_DIR:

vuln-research.sqlite
cases/
  <case-id>/
    evidence/
    exports/

SQLite uses foreign keys, WAL mode, prepared statements, and append-only event receipts. Source payloads and evidence are SHA-256 hashed.

Intelligence tools

Candidate ordering is research priority. It does not replace CVSS, VRT, reproduced impact, or program rules.

Research tools

Registering a scope here does not create permission. authorization_ref must point to the real bounty brief, contract, ticket, or lab authorization.

Normal workflow

1. Set VULN_IMPORT_ROOTS to the scanner-output directory.

2. Refresh recent CVEs, KEV, EPSS, and VRT.

3. Register the real program scope and validity window.

4. Create a case for one exact target and allowed method.

5. Run Semgrep, CodeQL, Trivy, Grype, or another approved scanner outside this MCP.

6. Import its SARIF output and record reproduction evidence.

7. Select a terminal VRT path and record actual impact.

8. Export a local draft for human review.

Scanner messages and advisory text are treated as untrusted data. They cannot change scope, tool selection, SQL, paths, or report structure.

Import security

• Import roots must be absolute and explicitly configured.

• Canonical paths must remain inside an allowed root.

• Symbolic-link imports, Windows device paths, and alternate data streams are rejected.

• Files are limited to 25 MiB by default.

• Stored evidence names are generated by the server.

• Duplicate evidence and SARIF results are identified by hashes or stable fingerprints.

Stale feeds and offline work

Call vuln_get_source_status before using cached intelligence. NVD, KEV, EPSS, and VRT are stale after 24 hours. Canonical CVE and OSV query state are stale after seven days.

If a source is unavailable, the last good cache remains readable. Set VULN_OFFLINE=true when a session must make no network requests.

Tests

The suite uses recorded fixtures by default. It covers schemas, source limits, origin isolation, scope matching, path containment, SARIF prompt-injection strings, evidence hashing, VRT assessment, report escaping, MCP discovery, and restart persistence.

evaluation.xml contains ten stable, read-only questions based on the fixed 2026 fixtures under tests/fixtures.

Build and seed those fixtures into a new absolute data directory before running the evaluations:

npm run seed:evaluation -- C:\absolute\unused\evaluation-data

The seeder refuses to overwrite an existing database. Point VULN_DATA_DIR at that directory when starting the evaluation server.