cve-mcp-server

Overview

CVE MCP Server is a comprehensive security intelligence toolset that transforms Claude into a full-spectrum security analyst. It integrates 27 tools across 21 APIs including NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more. The server enables parallel querying of multiple security sources and calculates composite risk scores, eliminating the need for manual cross-referencing. Built with Python using FastMCP framework, it includes rate limiting, response caching, and SQLite storage for efficient operations while maintaining privacy by blocking private IP lookups and processing only outbound HTTPS traffic.

Try asking AI

After installing, here are 6 things you can ask your AI assistant:

• lookup_cve

  Fetch detailed CVE record from NVD including CVSS scores, CWEs, affected products, references, and timeline

  Try:Look up CVE-2024-3400Try:Get details for CVE-2023-44487
• search_cves

  Search NVD for CVEs by keyword, product name, severity, or date range

  Try:Search for CVEs related to Apache Log4j with critical severityTry:Find all high-severity CVEs in 2023
• get_epss_score

  Get EPSS exploitation probability (0–1) and percentile for one or more CVEs

  Try:What's the EPSS score for CVE-2024-3400?Try:Get EPSS scores for these CVEs: CVE-2023-44487, CVE-2023-4966
• check_kev_status

  Check whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog

  Try:Is CVE-2021-44228 in the KEV catalog?Try:Check if CVE-2024-3400 is being actively exploited
• calculate_risk_score

  Compute composite 0–100 risk score using CVSS, EPSS, KEV status, and PoC availability

  Try:Calculate risk score for CVE-2024-3400Try:What's the risk score for CVE-2023-44487?
• generate_risk_report

  Generate a formatted executive security report for one or more CVEs with recommendations

  Try:Generate a risk report for CVE-2024-3400Try:Create an executive report for these CVEs: CVE-2023-44487, CVE-2023-4966
• lookup_ip_reputation

  Check IP address abuse history and confidence score via AbuseIPDB

  Try:Check reputation for IP 185.220.101.34Try:What's the abuse history for 8.8.8.8?
• virustotal_lookup

  Analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines

  Try:Check hash 44d88612fea8a8f36de82e1278abb02f on VirusTotalTry:Analyze https://suspicious-site.com on VirusTotal
• scan_dependencies

  Scan package names and versions against OSV.dev for known vulnerabilities

  Try:Scan these Python packages: requests 2.28.0, flask 2.0.1Try:Check for vulnerabilities in npm package lodash 4.17.21
• search_exploits

  Search GitHub for public proof-of-concept exploits and exploit code repositories

  Try:Find exploits for CVE-2024-3400Try:Search GitHub for proof-of-concept code for CVE-2023-44487
• get_mitre_techniques

  Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations

  Try:Map CVE-2021-44228 to MITRE ATT&CK techniquesTry:What MITRE techniques relate to CWE-79?
• shodan_host_lookup

  Get open ports, services, banners, and vulnerabilities for an IP via Shodan

  Try:Look up host information for 8.8.8.8 on ShodanTry:What ports are open on 1.1.1.1?

Comparable tools

Installation

# 1. Clone the repository
git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server

# 2. Create and activate a virtual environment
python -m venv venv

# macOS / Linux:
source venv/bin/activate

# Windows (PowerShell):
.\venv\Scripts\Activate.ps1

# 3. Install dependencies
pip install -e .

# 4. Copy and configure environment variables
cp .env.example .env
# Edit .env with your API keys

{
  "mcpServers": {
    "cve": {
      "command": "python",
      "args": ["-m", "cve_mcp_server"],
      "env": {
        "CVE_MCP_SERVER_API_KEYS": "YOUR_API_KEYS_HERE"
      }
    }
  }
}

FAQ

Do I need API keys for all the tools?

No. Most tools work without API keys but with limited rate limits. Keys are recommended for production use or high-volume queries.

How does the composite risk scoring work?

The risk score (0-100) combines CVSS severity, EPSS probability, CISA KEV status, PoC availability, and other factors into a normalized metric.

Is any sensitive data stored or logged?

The server maintains a local SQLite cache for performance but never logs API keys or sensitive data. Private IP addresses are blocked from all tools.

Compare cve-mcp-server with