CVE

The CVE MCP Server connects vulnerability intelligence, exploit intelligence, threat intelligence, network reputation data, package security data, and security reporting workflows to one local MCP endpoint.

Security engineers, vulnerability analysts, incident responders, DevSecOps teams, and platform teams can use it to query 27 security tools across 21 data sources from a single Claude session.

The MCP server runs on Python and FastMCP. It uses httpx for outbound API calls, aiosqlite for local caching, Pydantic v2 for typed models, and defusedxml for safe XML parsing.

The main workflow centers on CVE triage, exploit lookup, package scanning, suspicious IP checks, and executive reporting. The MCP server keeps every lookup outbound over HTTPS and stores cache data on the local machine.

Features

• Connects Claude to 27 security tools through the Model Context Protocol.
• Queries 21 security data sources for CVE records, threat signals, package advisories, network reputation, and malware intelligence.
• Calculates a composite 0-100 risk score from CVSS, EPSS, KEV status, and proof-of-concept availability.
• Generates executive risk reports for one CVE or a batch of CVEs.
• Ranks multiple CVEs by triage priority.
• Scans package versions against OSV.dev and GitHub Security Advisories.
• Checks suspicious IPs against AbuseIPDB, GreyNoise, Shodan, and CIRCL Passive DNS.
• Looks up hashes, domains, IPs, URLs, malware families, and ransomware wallet activity.
• Caches API responses in SQLite with per-resource TTL rules.
• Logs every tool invocation to a rotating local audit log.

How To Use It

Install the server with pip

Run these commands in a terminal:

git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server
python -m venv venv

macOS and Linux users can activate the environment with:

source venv/bin/activate

Windows PowerShell users can activate the environment with:

.\venv\Scripts\Activate.ps1

Windows Command Prompt users can activate the environment with:

venv\Scripts\activate.bat

Install the package in editable mode:

pip install -e .

Install the test dependencies with:

pip install -e ".[test]"

Start the server and confirm that Python can load the package:

python -m cve_mcp.server

Install the server with uv

uv users can create an environment and install the project with these commands:

git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server
uv venv
source .venv/bin/activate
uv pip install -e .
cp .env.example .env

Windows users should switch the activation command to .venv\Scripts\activate.

Configure environment variables

Copy the sample environment file:

cp .env.example .env

Set keys and runtime options in .env:

Add API keys in a practical order

The server can start with zero keys. Eight tools work in key-free mode: EPSS, CISA KEV, OSV.dev, MITRE ATT&CK, CWE lookups, CVSS parsing, Ransomwhere, and NVD at a lower rate.

Connect the server to Claude Desktop

macOS path:

~/Library/Application Support/Claude/claude_desktop_config.json

Windows path:

%APPDATA%\Claude\claude_desktop_config.json

Use absolute paths in the config:

{
  "mcpServers": {
    "cve-mcp": {
      "command": "python",
      "args": ["-m", "cve_mcp.server"],
      "cwd": "/absolute/path/to/cve-mcp-server",
      "env": {
        "NVD_API_KEY": "your-key-here",
        "GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxxxx",
        "ABUSEIPDB_KEY": "your-abuseipdb-key",
        "GREYNOISE_API_KEY": "your-greynoise-key",
        "SHODAN_KEY": "your-shodan-key"
      }
    }
  }
}

Connect the server to Claude Code

Claude Code can register the server from the shell:

claude mcp add cve-mcp -- python -m cve_mcp.server

Claude Code can load environment variables from .env:

claude mcp add cve-mcp --env-file .env -- python -m cve_mcp.server

Check the registration list with:

claude mcp list

Run the first queries

A no-key setup can answer common CVE questions right away. Start with prompts such as:

What is CVE-2021-44228? Is it actively exploited?

The server can answer this request. It queries NVD, EPSS, and CISA KEV.

A package scan prompt can start with:

Scan these Python packages for vulnerabilities: requests 2.28.0, flask 2.2.0, django 3.2.0

A higher-fidelity patching prompt can start with:

Calculate the risk score for CVE-2024-3400 and tell me if we should patch immediately.

Available MCP Tools

FAQs

Q: Which Claude clients can run CVE MCP Server?
A: Claude Desktop and Claude Code are the documented host environments. The transport uses stdio.

Q: Can the server run with no API keys?
A: Yes. EPSS, CISA KEV, OSV.dev, MITRE ATT&CK, CWE lookups, CVSS parsing, Ransomwhere, and lower-rate NVD access work in key-free mode.

Q: Which key should I add first?
A: NVD_API_KEY is the strongest first step. It raises NVD throughput from 5 requests per 30 seconds to 50 requests per 30 seconds.

Q: What does the risk score measure?
A: The risk score combines CVSS severity, EPSS exploitation probability, CISA KEV status, and proof-of-concept availability into one 0-100 number.

Q: Does the server scan my network or hosts directly?
A: No. The server performs intelligence lookups against external APIs. It does not probe internal infrastructure.

Q: Where does the server store its local data?
A: The default cache path is ~/.cve-mcp/cache.db. The default audit log path is ~/.cve-mcp/audit.log.

Q: Which IP ranges does the server block?
A: The documented blocked ranges include 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, ::1, and fc00::/7.

Q: Can the server calculate CVSS v4.0 scores on its own?
A: No. The local calculator handles CVSS v3.1. The server can still display CVSS v4.0 values returned by NVD.

Q: Can the server help with dependency triage?
A: Yes. scan_dependencies checks package versions against OSV.dev. scan_github_advisories adds GitHub advisory context for package ecosystems.