cvefeed-mcp

Model Context Protocol (MCP) server for the CVEFeed.io vulnerability intelligence API. Gives Claude Desktop, Cursor, Cline, and any other MCP-aware agent direct access to CVE search, project subscriptions, and vulnerability alerts.

Install

pip install cvefeed-mcp
# or
uvx cvefeed-mcp

Authenticate

Create a Project API Token at https://cvefeed.io/project/settings/api-tokens/, copy it, and export it alongside the numeric id of the project the token was issued for:

export CVEFEED_API_TOKEN=cvefeed_XXXXXXXX_...
export CVEFEED_PROJECT_ID=42

Each token is bound to exactly one project — one MCP install targets one project. The project id is the integer in your project dashboard URL (/project/detail/<slug>/; the numeric id is also shown in the project settings page).

Recommended scopes for full MCP functionality

MCP tools span four resource scopes. Grant read on every resource the agent may touch so it doesn't hit an "insufficient scope" error mid-task:

• vulnerabilities: read — CVE / CPE / CVEQL / EPSS discovery tools

• subscriptions: read (or write to let the agent add / remove product subscriptions)

• alerts: read (or write to let the agent mark alerts as read)

• activity_log: read — Enterprise only; required by read_project_activity_log

write implies read, so you don't need to tick both on the same resource.

Optionally override the base URL for staging or self-hosted deployments:

export CVEFEED_BASE_URL=https://cvefeed.io   # default

Use with Claude Desktop

Add to your ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or equivalent:

{
  "mcpServers": {
    "cvefeed": {
      "command": "uvx",
      "args": ["cvefeed-mcp"],
      "env": {
        "CVEFEED_API_TOKEN": "cvefeed_XXXXXXXX_...",
        "CVEFEED_PROJECT_ID": "42"
      }
    }
  }
}

Use with Cursor / Cline

Same MCP server config format — point command at cvefeed-mcp (or uvx cvefeed-mcp) and set CVEFEED_API_TOKEN + CVEFEED_PROJECT_ID in the env block.

Available tools

Every project-scoped tool targets the single project set via CVEFEED_PROJECT_ID; the LLM never passes a project id.

Local development

cd mcp-server
pip install -e ".[dev]"
pytest -v

Transport

Ships stdio transport only (what Claude Desktop, Cursor, and Cline expect). Remote streamable-HTTP transport may follow in a later release.

License

MIT