cve-mcp-server

Why we included this project

Manually triaging a single CVE usually means pulling up NVD, EPSS, CISA KEV, Shodan, VirusTotal, and a few more feeds in separate tabs, then trying to piece the signals together in your head. This server gives Claude one MCP surface over those sources, so a single question returns a correlated, evidence-backed answer instead of a pile of tabs. The triage_cve orchestrator is the reason to look at it: it queries the relevant feeds in parallel, blends them into a composite risk score with a hard override when CISA KEV flags active exploitation, and can return an SSVC v2 decision on deeper lookups, which is exactly the kind of automation that shortens patch-priority calls. It runs as a real Python service with async HTTP, an SQLite cache, rate limiting, and outbound-only HTTPS, so you can put it behind your firewall without opening inbound ports. For security teams that want agent-driven vulnerability workflows beyond a proof of concept, this is a solid place to start.