cve-mcp-server - Production-grade MCP server giving Claude 27 secur

项目说明

🛡️ CVE MCP Server

!CVE MCP Server

AI-powered security intelligence at your fingertips — 28 tools + a one-call triage_cve orchestrator, 24 data sources, one protocol.
![GARS-2026 Survey]()
![Python 3.10+]()
![MCP Compatible]()
![Security Tool]()
![FastMCP]()

A production-grade Model Context Protocol (MCP) server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs across NVD, EPSS, CISA KE, , and GreyNoise, ask Claude one question and get correlated intelligence in seconds. Built with Python, FastMCP, httpx, aiosqlite, Pydantic v2, and defusedxml.

The problem: Triaging a single C querying NVD for C, EPSS for exploitation probability, CISA KEV for acti status, GitHub for patches, and for malware associations — then mentally correlating e. For 50 CVEs, that's an entire day lost.

The solution: CVE MCP Ser Claude direct access to 28 security tools across 24 APIs — fronted by the triage_cve one-call orchestrator. Ask "Should we patch C?" and Claude fans out to every relevant source in parallel, calculates a composite risk score (with a CISA KEV hard o), and delivers a prioritized recommendation with e.

---

🌍 GARS-2026 — Global Agentic AI Readiness Survey

I'm running a global academic study measuring how ready security professionals,
de, and enterprise teams actually are for agentic AI — MCP servers,
tool calling, go, and human-in-the-loop workflows.

If you use this repo, your response would be a genuinely data point.

📋 Take the survey (10 min):
Survey

---

📑 Table of contents

---

🏗️ Architecture

All traffic is outbound HTTPS only — no inbound ports are opened. API keys are loaded from en and ne. Private/internal IP addresses are blocked from all lookup tools.

---

🔍 Tool catalog (28 tools)

⭐ Orchestration (v0.2.0) — start here

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| triage_cve | One-call triage that fans out NVD + EPSS + CISA KEV (+ public PoC for depth != "quick") concurrently, computes the composite risk score with a KEV hard o, falls back to NVD++ when NIST NVD is throttled, and on depth="deep" emits the SSVC v2 gated decision | Free / No key (key recommended) | triage_cve("C", depth="deep") |

> Also exposed via MCP primitives — Resources: ke, epss://scores/{cve_id}, manifest://tool-hash (SHA-256 over the registered tool surface, for tamper detection). Prompts: patch_decision, compare_and_prioritize, dependency_triage.

Core Intelligence (8 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| lookup_cve | Fetch detailed C from N C, CWEs, affected products, references, and timeline | Free / No key (key recommended) | lookup_cve("C") |
| search_cves | Search NVD for CVEs by keyword, product name, se, or date range | Free / No key (key recommended) | search_c="Apache Log4j", se="CRITICAL") |
| get_epss_score | Get EPSS exploitation probability (0–1) and percentile for one or more CVEs | Free / No key | get_epss_score("C") |
| check_ke | Check whether a C in CISA's Known Exploited catalog | Free / No key | check_ke("C") |
| get_c | Parse and explain a CVSS v3.1 string with per-metric breakdown | Free / No key | get_c("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") |
| get_cwe_info | Look up Common Weakness Enumeration details by CWE ID from embedded database | Free / No key | get_cwe_info("CWE-79") |
| get_c | Extract and categorize all reference links for a C, ad, exploits) | Free / No key (key recommended) | get_c("C") |
| bulk_c | Batch-fetch details for up to 20 CVEs in a single call with parallel enrichment | Free / No key (key recommended) | bulk_c(["C", "C"]) |

Exploit & Attack Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| search_exploits | Search GitHub for public proof-of-concept exploits and exploit code repositories | GITHUB_TOKEN (optional) | search_exploits("C") |
| get_mitre_techniques | Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations | Free / No key | get_mitre_techniques("C") |
| check_poc_a | Determine if known proof-of-concept code exists for a C multiple sources | GITHUB_TOKEN (optional) | check_poc_a("C") |
| get_attack_patterns | Retrie attack pattern details associated with a CWE or CVE | Free / No key | get_attack_patterns("CWE-89") |

Phase 3: Ad Risk & Reporting (4 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| calculate_risk_score | Compute composite 0–100 risk score using CVSS, EPSS, KE, and PoC a | Free / No key (key recommended) | calculate_risk_score("C") |
| generate_risk_report | Generate a formatted executi report for one or more CVEs with recommendations | Free / No key (key recommended) | generate_risk_report(["C", "C"]) |
| prioritize_cves | Rank a list of CVEs by composite risk score for triage prioritization | Free / No key (key recommended) | prioritize_cves(["C", "C", "C"]) |
| get_trending_cves | Retrie C on high EPSS scores and recent KE | Free / No key | get_trending_cves(days=7, min_epss=0.5) |

Network Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| lookup_ip_reputation | Check IP address abuse history and confidence score | ABUSEIPDB_API_KEY | lookup_ip_reputation("185.220.101.34") |
| check_ip_noise | Query GreyNoise for IP scan/attack activity, classification, and associated CVEs | GREYNOISE_API_KEY | check_ip_noise("185.220.101.34") |
| shodan_host_lookup | Get open ports, services, banners, and for an IP | SHODAN_API_KEY | shodan_host_lookup("8.8.8.8") |
| passi | Retrie DNS resolution data for a domain from CIRCL Passive DNS | CIRCL_PDNS_USER + CIRCL_PDNS_PASSWORD | passi("example.com") |

Threat Intelligence (4 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| | Analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines | | (hash="44d88612fea8a8f36de82e1278abb02f") |
| search_malware | Search MalwareBazaar for malware samples by hash, tag, or signature | ABUSECH_AUTH_KEY (optional) | search_malware(tag="Emotet") |
| search_iocs | Query ThreatFox for Indicators of Compromise linked to malware families | ABUSECH_AUTH_KEY (optional) | search_iocs(malware="CobaltStrike") |
| check_ransomware | Look up ransomware payment addresses and transaction data from Ransomwhere | Free / No key | check_ransomware(address="bc1q...") |

De (3 tools)

| Tool | Description | API Key Required | Example Usage |
|------|-------------|-----------------|---------------|
| scan_dependencies | Scan package names and against OSV.dev for known | Free / No key | scan_dependencies(ecosystem="PyPI", packages={"requests": "2.28.0"}) |
| scan_github_ad | Search GitHub Security Ad by ecosystem, package, or se | GITHUB_TOKEN (optional) | scan_github_ad(ecosystem="pip", package="django") |
| urlscan_check | Submit a URL for scanning or retrie scan results from URLScan.io | URLSCAN_API_KEY | urlscan_check(") |

---

📦 Installation

Prerequisites

Step-by-step setup

Using u alternative)

With test dependencies

---

🔑 API keys setup

API keys are organized by priority — get the Tier 1 keys first for maximum co with free tools, then progressively add Tier 2 and Tier 3 as needed.

Tier 1: High priority (free, instant access, maximum co)

| EN | Enables | How to Get | Free Tier Limits | Required? |
|-------------|---------|-----------|-----------------|-----------|
| N | 10× faster N (50 req/30s vs 5) | Request at nvd.nist.gov | 50 requests per 30 seconds | Optional but strongly recommended |
| GITHUB_TOKEN | GitHub Ad search + exploit PoC search | Create PAT at github.com/settings/tokens | 5,000 requests/hour | Optional (60/hr without) |

Tier 2: Recommended (free accounts, significant value)

| EN | Enables | How to Get | Free Tier Limits | Required? |
|-------------|---------|-----------|-----------------|-----------|
| ABUSEIPDB_KEY | IP reputation lookups | Register at abuseipdb.com | 1,000 checks/day | Required for IP tools |
| | File/URL/domain/IP malware scanning | Sign up at .com | 500 lookups/day, 4/min | Required for |
| GREYNOISE_API_KEY | IP noise/scan activity intelligence | Sign up at .io | 50 queries/week (community) | Required for GreyNoise tools |
| SHODAN_KEY | Host/port/service reconnaissance | Register at account.shodan.io | Basic host lookups (free tier) | Required for Shodan tools |

Tier 3: Optional (extended intelligence)

| EN | Enables | How to Get | Free Tier Limits | Required? |
|-------------|---------|-----------|-----------------|-----------|
| URLSCAN_KEY | URL scanning and website analysis | Sign up at urlscan.io | 5,000 public scans/day | Optional |
| CIRCL_PDNS_USER | CIRCL Passive DNS lookups | Request access at circl.lu | Partner access only | Optional |
| CIRCL_PDNS_PASS | CIRCL Passive DNS authentication | Provided with CIRCL registration | Partner access only | Optional |

> ⚡ Zero-key start: Eight tools work without any API key — EPSS, CISA KEV, OSV.de ATT&CK, CWE lookups, C, Ransomwhere, and NVD (at reduced rate). You can start using the ser and add keys progressively.

---

⚙️ Configuration

En (.en)

Claude Desktop configuration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

> ⚠️ Important: Always use absolute paths. Fully quit Claude Desktop (Cmd+Q / Alt+F4) after changing the config — reloading is not enough.

Claude Code configuration

---

🚀 Quick start

Step 1: Install (2 minutes)

Step 2: Test with free tools first

No .env file needed. Add the server to Claude Desktop or Claude Code and try:

> "What is C? Is it actively exploited?"

Claude will use lookup_cve (NVD), get_epss_score (EPSS), and check_kev (CISA KEV) — all free, no keys required.

> "Scan these Python packages for : requests 2.28.0, flask 2.2.0, django 3.2.0"

Step 3: Add your first key for 10× performance

Request a free NVD key at nvd.nist.gov — instant , increases rate limit from 5 to 50 requests per 30 seconds.

Step 4: Full power mode

Once you' Tier 1 and Tier 2 keys:

> "Calculate the risk score for C and tell me if we should patch immediately."

---

💬 Usage examples

Scenario 1: "Should we patch Log4Shell immediately?"

> You: Analyze if C (Log4Shell) needs immediate patching. Give me the risk score and your recommendation.

Claude orchestrates multiple tools behind the scenes:

Claude's response: "C scores 97/100 (CRITICAL). Remote code execution in Apache Log4j, CVSS 10.0, 97.5% EPSS probability, confirmed acti in CISA KE ransomware campaigns, 300+ public exploits. Patch immediately."

Scenario 2: "Scan my Python requirements.txt"

> You: Scan these dependencies: requests==2.28.0, flask==2.2.0, django==3.2.0, pillow==9.0.0, cryptography==37.0.0

Claude's response: "Found 12 across your packages. Immediate action: Django 3.2.0 (3 critical C SQL injection), Pillow 9.0.0 (heap o), cryptography 37.0.0 (OpenSSL chain). Upgrade to: django>=4.2.16, pillow>=10.3.0, cryptography>=42.0.0."

Scenario 3: "In a suspicious IP"

> You: In suspicious IP 185.220.101.34 — is it malicious?

Claude's response: "185.220.101.34 is a known Tor exit node rated 100% malicious by AbuseIPDB with 4,832 abuse reports. GreyNoise confirms acti for C (Palo Alto) and C (Ivanti). Recommendation: Block at firewall."

Scenario 4: "Generate an executi report"

> You: Generate an executi report for: C, C, C, C

---

📊 Risk score explained

The calculate_risk_score tool produces a composite risk score from 0 to 100 by weighting four independent signals.

The formula

| Component | Weight | What It Captures |
|-----------|--------|-----------------|
| CVSS v3.1 Base Score | 20% | Theoretical worst-case se |
| EPSS Probability | 35% | Statistical likelihood of exploitation in the next 30 days |
| CISA KE | 30% | Confirmed acti in the wild |
| PoC A | 15% | Public exploit code lowers the barrier for attackers |

Boost multipliers

Score is capped at 100.

Risk Scoring — v1 (2026-06)

The numeric scorer is scoring_ 1.0 (surfaced in triage_cve, calculate_risk_score, and health_check). The linear weighted sum above is the v1 default for the *numeric* score, with one hard o:

| Score | Label | Recommended Action |
|-------|-------|--------------------|
| 0 – 25 | LOW | Schedule for next maintenance window |
| 26 – 50 | MEDIUM | Patch within 30 days per SLA |
| 51 – 75 | HIGH | Patch within 7 days; escalate to team lead |
| 76 – 100 | CRITICAL | Patch within 24–48 hours. Emergency change window. |

Why these weights?

EPSS gets the highest weight (35%) because it's the single best predictor of actual exploitation — far better than C. A CVSS 10.0 with EPSS 0.01 is theoretically dangerous but practically unlikely. KEV at 30% is ground truth: confirmed exploitation, not a prediction. CVSS at 20% captures se context for new CVEs with insufficient EPSS data. PoC at 15% reflects that public exploits dramatically accelerate real-world attacks.

---

🆕 What's new in v0.2.0

---

🌐 Data sources

| # | Source | Data Provided | Auth | Rate Limit (Free) |
|---|--------|--------------|------|-------------------|
| 1 | NVD | C, CVSS, CWEs, CPEs | apiKey header (optional) | 5 req/30s (50 with key) |
| 2 | EPSS | Exploitation probability and percentiles | None | 1,000 req/min |
| 3 | CISA KEV | Actively exploited C | None | Static file |
| 4 | OSV.dev | Open-source package | None | No published limit |
| 5 | GitHub Ad | GHSA ad, patches, affected | Bearer token | 60/hr (5,000 with PAT) |
| 6 | MITRE ATT&CK | TTPs, techniques, mitigations | None | No published limit |
| 7 | AbuseIPDB | IP abuse confidence, reports, ISP, geo | Key header | 1,000 checks/day |
| 8 | GreyNoise | IP noise/scan activity, classification | key header | 50 queries/week |
| 9 | Shodan | Open ports, services, banners, CVEs | key query param | Basic lookups |
| 10 | | Multi-AV scan results, reputation | x-apikey header | 500/day, 4/min |
| 11 | MalwareBazaar | Malware samples, hashes, signatures | Auth-Key header | Fair use |
| 12 | ThreatFox | IOCs linked to malware families | Auth-Key header | Fair use |
| 13 | Ransomwhere | Ransomware BTC addresses and transactions | None | No published limit |
| 14 | URLScan.io | URL scanning, screenshots, DOM | API-Key header | 5,000 public scans/day |
| 15 | CIRCL PDNS | Historical passive DNS records | HTTP Basic Auth | Partner access |
| 16 | GitHub Code Search | Exploit PoC repository search | Bearer token | Shared with GHSA limits |
| 17 | Exploit-DB | Public exploit database CSV | None | No published limit |
| 18 | Nuclei Templates | Community detection templates | None | No published limit |
| 19 | MSRC | Microsoft security ad | None | No published limit |
| 20 | Red Hat Security | Red Hat C | None | No published limit |
| 21 | Ubuntu Security | Ubuntu C | None | No published limit |
| 22 | NVD++ | N C (transparent N) | Bearer token (free Community) | Per Community tier |
| 23 | CIRCL hashlookup | Known-good file metadata (NSRL + others), hashlookup:trust | None | Best-effort |
| 24 | HIBP Pwned Passwords | Breached-password counts range API | None | No hard limit |

---

🧪 Running tests

Test with the MCP Inspector

Opens at — interactively test each tool, view input schemas, and inspect response formats.

What tests cover

---

🏛️ Architecture deep dive

File structure

Caching strategy

| Resource | TTL |
|----------|-----|
| C (NVD) | 1 hour |
| EPSS scores | 6 hours |
| KE | 1 hour |
| IP / domain intel | 1 hour |
| Exploit-DB CSV | 24 hours |
| ATT&CK STIX data | 24 hours |
| Ransomware intel | 24 hours |

Audit log

Every tool in is logged to ~/.c/audit.log:

API keys and response payloads are ne to audit logs.

---

🔐 Security and privacy

What data leaves your machine

Private IP blocking

All network intelligence tools block private and reserved IP ranges before any external API call:

API key protection

XML safety

defusedxml is used for all XML parsing to prevent XML bomb attacks (billion laughs, XXE injection).

---

🔧 Troubleshooting

Server won't start

Claude Desktop doesn't show the hammer icon (🔨)

NVD rate limited

The ser excess requests automatically, but with a key you get 10× throughput.

GreyNoise 401 Unauthorized

Windows encoding issues

---

🗺️ Roadmap and known limitations

What the server does NOT do

Known API limitations

Planned impro

---

🤝 Contributing

Contributions are welcome.

Adding a new tool

1. Add the tool function in server.py with the @mcp.tool() decorator
2. Add input in utils/.py
3. Implement the API client in api/
4. Add tests in tests/
5. Update this README

Testing requirements

---

📄 License

MIT License — see LICENSE for details.

---

<p align="center">
Built with 🔐 by <a href=" Jangra</a> · Berlin, Germany<br>
<em>Turning security intelligence into con.</em>
</p>

项目信息

开发语言：Python

Star 数：1613

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。