The PatrowlIntelMCP server provides read-only access to PatrowlIntel's vulnerability intelligence, exposing three tools to any MCP-compatible client:

• search_cves — Search and filter the CVE feed using criteria such as:

  • Free-text search on CVE ID or summary

  • Minimum Patrowl EASM risk score (min_score, 0–1)

  • Minimum EPSS exploit probability (min_epss, 0–1)

  • CISA KEV catalog entries only (is_kev)

  • CVEs with at least one public exploit (has_exploit)

  • Remotely exploitable CVEs (is_remote)

  • Vendor/product technology scope (e.g. Apache, Fortinet FortiOS)

  • Publication date range (published_from / published_to)

  • Sorting and pagination (up to 100 per request)

• get_cve — Retrieve the full intelligence record for a single CVE, including CVSS scores/vectors, EPSS probability, CISA KEV status and dates, CISA SSVC decision, public exploit links, affected technologies/CPEs, weaknesses (CWEs), and references.

• list_trending_attacks — List recently trending threats and actively discussed attacks, filterable by minimum severity (0=Info to 4=Critical) and publication date, sorted most-recent first (up to 100 per request).

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PatrowlIntelMCP search for CVEs with public exploits"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.