VulnMCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VULNMCP_LOOKUP_URL | No | Base URL for the Vulnerability Lookup API | https://vulnerability.circl.lu |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| classify_severityA | Classify the severity of a vulnerability based on its description. Uses CIRCL's fine-tuned transformer models:
Language is auto-detected from the text unless explicitly specified. |
| classify_cweA | Classify a vulnerability description into CWE categories. Uses CIRCL's fine-tuned RoBERTa model to predict the most likely CWE (Common Weakness Enumeration) categories, mapped to their parent CWEs. |
| get_recent_vulnerabilities_by_cweA | Fetch the 3 most recent vulnerabilities for a given CWE ID from Vulnerability Lookup. |
| get_vulnerabilityA | Get detailed information about a vulnerability by its ID from Vulnerability Lookup. The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable. |
| search_vulnerabilitiesB | Search vulnerabilities on Vulnerability Lookup with filters. The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable. |
| search_sightingsA | Search sightings to identify actively discussed or exploited vulnerabilities. |
| create_sightingA | Create a sighting for a vulnerability. Requires an API key on most Vulnerability Lookup instances. Set VULNMCP_API_KEY to authenticate automatically. |
| get_most_sighted_vulnerabilitiesA | Get vulnerabilities ranked by sighting activity. This helps quickly prioritize vulnerabilities with high real-world activity and distinguish potentially important issues from minor ones. |
| list_kev_entriesA | List and filter Known Exploited Vulnerability (KEV) entries. Use this tool to browse KEV catalogs, check if a specific vulnerability is in a KEV catalog, or find recently added KEV entries. KEV catalogs are identified by the UUID of their Vulnerability-Lookup origin instance. Use the list_gcve_references tool to discover available KEV catalogs and their UUIDs. Known catalogs include:
The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable. |
| search_commentsA | Search comments related to vulnerabilities on Vulnerability Lookup. Comments are community-contributed notes, analyses, or discussions attached to specific vulnerabilities. |
| search_bundlesA | Search bundles related to vulnerabilities on Vulnerability Lookup. Bundles are curated collections of related vulnerabilities, useful for grouping CVEs that affect the same campaign, product, or incident. |
| guess_cpesA | Guess CPE values from product-related keywords using cpe-guesser. The base URL defaults to https://cpe-guesser.cve-search.org and can be overridden with the VULNMCP_CPE_GUESSER_URL environment variable. |
| list_gna_entriesA | List all Global Numbering Authorities (GNA) from the GCVE registry. Downloads and verifies the registry if not already cached locally. Returns: A dict with the total count and list of all GNA entries, each containing id, short_name, full_name, cpe_vendor_name, and URLs. |
| get_gna_entryA | Get a specific GNA entry by its numeric ID or exact short name. Exactly one of id or short_name must be provided. |
| search_gnaA | Search for GNA entries by name (case-insensitive substring match). |
| list_gcve_referencesA | List GCVE references (vulnerability dataset sources and their GNA mappings). This includes KEV catalog entries with their Vulnerability-Lookup origin UUIDs, which can be used with the list_kev_entries tool's vulnerability_lookup_origin parameter to query a specific catalog. Downloads references if not already cached locally. Returns: A dict with the reference categories and their entries, including KEV catalogs with uuid, short_name, and optional gna_id fields. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 16 tools
Each tool targets a distinct resource and action: classification, vulnerability lookup, sightings, KEV, comments, bundles, CPE guessing, and GNA registry. The GNA tools (get, list, search) are differentiated by query type, and no two tools appear to do the same thing.
All tool names follow a consistent lowercase snake_case verb_noun pattern (e.g., classify_severity, search_vulnerabilities, list_kev_entries). Verbs are uniform and predictable, with no mixing of conventions.
With 16 tools, the count is slightly above the ideal 3-15 range but each tool serves a distinct purpose in the vulnerability intelligence domain. The breadth of features (search, classify, sightings, KEV, comments, bundles, CPE guessing, GNA) justifies the size, though it borders on heavy.
The tool set covers vulnerability search, retrieval, classification, sightings, KEV, comments, bundles, CPE guessing, and GNA registry, providing a comprehensive read and analysis surface. Minor gaps exist such as no create/update/delete operations for comments or bundles, but these are likely out of scope for this server.