Best for
- Security operations, vulnerability-management, and DevSecOps teams.
- Claude users who need aggregated security data from multiple public sources.
- Teams that want to start with key-free tools and add API credentials progressively.
C
CVE MCP Server
Community
Turn Claude into a security intelligence analyst.
GitHub source repository ↗
50FMRS · D
This is a broad vulnerability-management and security-intelligence MCP server with 28 tools, 24 data sources, a triage_cve orchestrator, local caching, audit logging, and private-IP blocking. The README contains an MIT-versus-repository-metadata Apache-2.0 license inconsistency, so the actual LICENSE file should be checked before adoption.
CVE MCP Server is a Python and FastMCP security-intelligence MCP server that gives Claude access to CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, exploit intelligence, IP intelligence, malware data, dependency scanning, and risk reporting. Its triage_cve orchestrator aggregates multiple sources in parallel and computes a composite risk score with a CISA KEV hard override.
Tools
triage_cve
Fans out to NVD, EPSS, CISA KEV, and public PoC sources, computes composite risk, and returns remediation guidance; deep mode also emits an SSVC v2 decision.
lookup_cve
Fetches CVE details, CVSS, CWEs, affected products, references, and timeline data from NVD.
search_cves
Searches NVD CVEs by keyword, product, severity, or date range.
get_epss_score
Returns EPSS exploitation probability and percentile for one or more CVEs.
check_kev_status
Checks whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog.
get_cvss_details
Parses and explains a CVSS v3.1 vector and its individual metrics.
get_cwe_info
Looks up CWE details from an embedded database.
get_cve_references
Extracts and categorizes patch, advisory, and exploit references for a CVE.
bulk_cve_lookup
Batch-fetches details for up to 20 CVEs with parallel enrichment.
search_exploits
Searches GitHub for public proof-of-concept exploits and exploit repositories.
get_mitre_techniques
Maps a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations.
check_poc_availability
Checks multiple sources for known proof-of-concept code for a CVE.
get_attack_patterns
Retrieves CAPEC attack-pattern details associated with a CWE or CVE.
calculate_risk_score
Computes a composite 0–100 risk score using CVSS, EPSS, KEV status, and PoC availability.
generate_risk_report
Generates a formatted security report with recommendations for one or more CVEs.
prioritize_cves
Ranks a list of CVEs by composite risk score.
get_trending_cves
Retrieves trending CVEs based on high EPSS scores and recent KEV additions.
lookup_ip_reputation
Checks IP abuse history and confidence through AbuseIPDB.
check_ip_noise
Queries GreyNoise for IP scanning or attack activity, classification, and associated CVEs.
shodan_host_lookup
Gets open ports, services, banners, and vulnerabilities for an IP through Shodan.
passive_dns_lookup
Retrieves historical DNS resolution data for a domain from CIRCL Passive DNS.
virustotal_lookup
Analyzes file hashes, URLs, domains, or IPs through VirusTotal.
search_malware
Searches MalwareBazaar samples by hash, tag, or signature.
search_iocs
Queries ThreatFox for IOCs associated with malware families.
check_ransomware
Looks up ransomware payment addresses and transaction data from Ransomwhere.
scan_dependencies
Scans package names and versions for known vulnerabilities through OSV.dev.
scan_github_advisories
Searches GitHub Security Advisories by ecosystem, package, or severity.
urlscan_check
Submits a URL for scanning or retrieves existing URLScan.io results.
Setup
Python 3.10+, pip or uv, and Git are required. Clone the repository, create a virtual environment in the repository root, run pip install -e ., and start it with python -m cve_mcp.server. Optionally copy .env.example to configure environment variables. Claude Desktop uses an absolute cwd path; Claude Code can use claude mcp add cve-mcp -- python -m cve_mcp.server.
claude_desktop_config.json
{"mcpServers":{"cve-mcp":{"command":"python","args":["-m","cve_mcp.server"],"cwd":"/absolute/path/to/cve-mcp-server","env":{"NVD_API_KEY":"your-key-here","GITHUB_TOKEN":"ghp_xxxxxxxxxxxxxxxxxxxx","ABUSEIPDB_KEY":"your-abuseipdb-key","GREYNOISE_API_KEY":"your-greynoise-key","SHODAN_KEY":"your-shodan-key"}}}}
Fit and risk
Not for
- Active scanning or probing of infrastructure.
- Workflows requiring writes to external systems or automated remediation.
- Use cases requiring a local CVSS v4.0 calculator.
Required permissions
- Requires outbound HTTPS access to the relevant external APIs.
- API keys are supplied through environment variables; some network, threat, and URL tools require specific credentials.
- Stores responses in a local SQLite cache and writes an audit log.
- urlscan_check can submit URLs for scanning; most other functions are read-oriented.
Risks and side effects
- CVE IDs, IPs, hashes, domains, and package names are sent to the relevant external APIs.
- Provider rate limits, credential requirements, and data freshness can affect results.
- The risk score is a composite indicator and does not replace human judgment; KEV entries are forced to at least CRITICAL/76.
- The server does not actively scan, but URLScan submissions send URLs to that service.
Troubleshooting
- Confirm Python 3.10 or newer and install the project inside the active virtual environment.
- Use absolute paths in Claude Desktop configuration and fully quit and restart Claude Desktop after changes.
- For NVD throttling, configure NVD_API_KEY; verify the required environment-variable names and values for other tools.
- For GreyNoise connection issues, confirm the server uses the /v3/ip/{ip} endpoint.
- Use claude mcp list or MCP Inspector to verify the server connection.
Use cases
Assess CVE severity, exploitation probability, and confirmed exploitation status.
Scan dependencies and prioritize remediation.
Investigate suspicious IPs, domains, file hashes, and malware indicators.
Generate vulnerability comparisons, prioritization, and executive reports.
Supported clients
Claude DesktopFull support
Claude CodeFull support