CVE MCP Server
Retrieve vulnerability intelligence across 24 data sources via 28 integrated tools.
Data last scanned today · Reviewed yesterday
Overview
CVE MCP Server acts as an automated security analyst by aggregating data from sources like NVD, EPSS, CISA KEV, Shodan, and VirusTotal directly into your AI assistant. It provides a triage orchestrator that parallelizes these queries to deliver evidence-based risk recommendations for specific CVE identifiers. The server uses FastMCP and Python to consolidate security research that typically requires multiple manual browser lookups. By automating the cross-referencing of exploit probabilities and active exploitation status, it aims to reduce the time spent on manual vulnerability assessment.
Our verdict
This server carries a high risk level with a security score of 33/100. The primary concern is the total lack of an authentication method, which allows anyone with access to the configuration file to utilize the server. Furthermore, the absence of a read-only mode means the server operates with full access capabilities, making it unsuitable for environments where strict access control and security isolation are required.
- Orchestrates queries across 24 distinct security data sources
- Provides a unified triage command for complex vulnerability analysis
- Contains zero direct software dependencies to minimize supply chain surface
- Maintained through frequent updates with the latest commit 3 days ago
- Zero authentication mechanisms leave the server exposed to unauthorized access
- Operates without a read-only mode, granting full execution access
- Community-maintained project rather than an official vendor release
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the system requirements for running the CVE MCP server?
The server requires Python 3.10 or higher.
›Does the server require any specific network configuration?
The server uses outbound HTTPS only and does not require any inbound ports to be opened.
›How are sensitive credentials handled by the server?
API keys are loaded via environment variables and are not logged by the system.
›What measures are in place to handle local network security?
The server includes logic to block all lookups involving private or internal IP addresses.
Alternatives
Changelog
- Security
- Improvedv0.1.0
2026-04-14
Badge
Maintain this server? Add the live badge to your README.