Triaging a single CVE the manual way means opening tab after tab: NVD for the CVSS score, EPSS for exploitation probability, CISA KEV for confirmed exploitation, GitHub for patches, VirusTotal for malware links, then stitching it all together in your head. CVE MCP Server removes that busywork. It is an open source Model Context Protocol (MCP) server that plugs into Claude and hands it a full security intelligence toolkit, so you can ask one question, like "Should we patch this CVE immediately?", and get a correlated, evidence-backed answer in seconds.
The project is mukul975/cve-mcp-server, described on GitHub as a production-grade MCP server giving Claude security intelligence tools across many APIs, covering CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more. At the time of writing it holds 1,674 stars and 271 forks on GitHub, and it was created on April 14, 2026. Watch the 30-second repo signal: Turn Claude into an Automated CVE Analyst.
Key Takeaways
CVE MCP Server gives Claude a catalog of 28 security tools across 24 data sources, fronted by a one-call `triage_cve` orchestrator.
Its composite risk score blends CVSS, EPSS, CISA KEV status, and proof-of-concept availability into a 0 to 100 score, with a hard override that keeps every KEV-listed CVE at CRITICAL.
Eight tools work with no API key at all, so you can start free and add keys later for higher rate limits and extra sources.
It is lookup and intelligence only: it does not actively scan your infrastructure or make changes to it.
Setup is a standard Python install plus one MCP server entry in Claude Desktop or Claude Code.
What Is CVE MCP Server?
MCP is the open protocol that lets AI assistants call external tools in a standard way. CVE MCP Server is a Python server built with FastMCP that exposes security tools over that protocol. Connect it to Claude Desktop or Claude Code, and Claude can call those tools directly during a conversation, instead of you pasting data from a dozen websites into the chat.
The README frames the problem plainly: triaging one CVE means querying several sources and correlating them mentally, and triaging 50 CVEs that way costs an entire day. The server's answer is to fan out to every relevant source in parallel, compute a composite risk score, and return a prioritized recommendation with evidence. All traffic is outbound HTTPS only, no inbound ports are opened, and API keys are loaded from environment variables and never logged, according to the project's security notes (CVE MCP Server README).
One Call Does the Triage: Meet triage_cve
The star of the catalog is `triage_cve`, added in version 0.2.0. Instead of calling tools one by one, you ask Claude to triage a CVE and this orchestrator fans out to NVD, EPSS, and CISA KEV concurrently, adds public proof-of-concept discovery at deeper levels, computes the composite risk score, and returns a clean report. It takes a `depth` parameter: `quick`, `standard` (the default), or `deep`, where `deep` additionally emits an SSVC v2 gated decision, a qualitative alternative to the numeric score.
The README's Log4Shell example shows the flow. For CVE-2021-44228, the orchestrator pulls the NVD record (CVSS 3.1 score 10.0, CRITICAL), the EPSS probability, the CISA KEV entry, and proof-of-concept availability, then produces a risk score of 97 out of 100 with a "patch immediately" urgency. That is the whole pitch in one call: correlation, not just lookup.
How the Risk Score Works
A single number is only useful if you can see how it was built. CVE MCP Server publishes its formula, which is a weighted sum of four signals:
Component | Weight | What it captures |
|---|---|---|
CVSS v3.1 base score | 20% | Theoretical worst-case severity |
EPSS probability | 35% | Statistical likelihood of exploitation in the next 30 days |
CISA KEV status | 30% | Confirmed active exploitation in the wild |
Proof-of-concept availability | 15% | Public exploit code lowers the barrier for attackers |
EPSS carries the highest weight because, in the project's own reasoning, it is the best predictor of actual exploitation, while CVSS alone describes severity, not likelihood. Boost multipliers then adjust the result: KEV plus an active proof of concept multiplies by 1.15, a CVSS of 9.0 or higher combined with EPSS above 0.7 multiplies by 1.10, and a CVE published less than 7 days ago multiplies by 1.05. Scores are capped at 100.
The most important rule is the KEV hard override. A CVE listed in CISA KEV is confirmed exploited in the wild, so its label can never drop below CRITICAL and its score is clamped to at least 76, regardless of CVSS or EPSS. The resulting bands are simple: 0 to 25 is LOW, 26 to 50 is MEDIUM, 51 to 75 is HIGH, and 76 to 100 is CRITICAL, with CRITICAL meaning patch within 24 to 48 hours.
The Full Tool Catalog
Beyond the orchestrator, the catalog covers six areas. Core vulnerability intelligence handles CVE lookup and search, EPSS scores, KEV checks, CVSS vector explanations, CWE details, reference extraction, and bulk lookup of up to 20 CVEs in one call. Exploit and attack intelligence searches for public proof-of-concept code, maps CVEs to MITRE ATT&CK techniques, and pulls CAPEC attack patterns. Advanced risk and reporting tools calculate scores, rank a list of CVEs, surface trending CVEs, and generate executive reports.
Network intelligence covers IP reputation, GreyNoise noise checks, Shodan host lookups, and passive DNS. Threat intelligence adds VirusTotal lookups, MalwareBazaar searches, ThreatFox indicators of compromise, and ransomware address lookups. Finally, DevSecOps tools scan package dependencies against OSV.dev, search GitHub Security Advisories, and check URLs with URLScan.io. In total the README lists 24 data sources, from NVD and EPSS to MSRC, Red Hat, and Ubuntu advisories, plus VulnCheck NVD++ as an automatic fallback when NIST NVD is throttled.
Getting Started: Free First, Keys Later
Setup follows the standard Python path. You need Python 3.10 or newer (3.11 or 3.12 recommended), pip or uv, and Git. Clone the repository, create a virtual environment, install with `pip install -e .`, copy `.env.example` to `.env`, and verify the server starts with `python -m cve_mcp.server`. For Claude Desktop, add a `cve-mcp` entry to the MCP servers config pointing at the server; for Claude Code, the README gives a one-line `claude mcp add` command.
The pleasant surprise is the zero-key start. Eight tools work with no API key: EPSS, CISA KEV, OSV.dev, MITRE ATT&CK, CWE lookups, CVSS parsing, Ransomwhere, and NVD at a reduced rate. That means you can test the server immediately with a question like "What is CVE-2021-44228? Is it actively exploited?" and only add keys when you want more. A free NVD key raises the NVD rate limit from 5 to 50 requests per 30 seconds, and a GitHub token raises GitHub API limits from 60 to 5,000 requests per hour. Other tools need their own keys: AbuseIPDB, VirusTotal, GreyNoise, Shodan, and URLScan.io each require one, and CIRCL passive DNS needs partner access.
What It Does Not Do
Honest limits matter for a security tool, and the README states them clearly. CVE MCP Server does no active scanning: it is intelligence and lookup only, and it does not probe your infrastructure. It performs no write operations, except URLScan submissions. Its built-in CVSS calculator handles version 3.1 only; NVD-provided 4.0 scores are displayed but not recalculated. There are also upstream limits to know: NVD returns at most 2,000 results per query, EPSS scores for CVEs less than 24 hours old may not exist yet, CISA KEV updates on US business days only, and GreyNoise community tier allows 50 queries per week.
On the privacy side, the design is reassuring for a tool that handles sensitive queries. CVE IDs, IPs, hashes, domains, and package names are sent to the respective lookup APIs, but responses are cached locally in SQLite, private and reserved IP ranges are blocked before any external call, and API keys and response payloads are never written to the audit log. Every tool invocation is logged locally with its duration and status, which helps if you ever need to review what was queried.
Who Should Try It?
CVE MCP Server fits security engineers triaging vulnerability backlogs, developers checking whether a dependency upgrade is urgent, and small teams that cannot afford a commercial threat intelligence platform but still need prioritized answers. It also fits anyone learning vulnerability management, because the risk score formula and the tool-by-tool evidence trail teach the difference between severity, likelihood, and confirmed exploitation. If you already follow vulnerability news, the companion explainer PHP2Shell Explained: Two Critical PHP Flaws and How to Patch Yours shows why that distinction matters in practice.
It is less useful if you need active scanning, continuous monitoring with alerts, or SIEM integration: webhook alerting for KEV additions and STIX 2.1 export are listed as planned improvements, not current features. Treat it as an analyst's assistant, not a monitoring platform.
Frequently Asked Questions
Is CVE MCP Server free?
Yes. The project is open source, and eight tools work with no API key at all. Optional free-tier keys from NVD, GitHub, AbuseIPDB, VirusTotal, GreyNoise, Shodan, and others unlock higher limits and extra tools.
Does it work with AI assistants other than Claude?
It is an MCP server, so any MCP-compatible client can use it in principle, but the README documents Claude Desktop and Claude Code setups specifically. The server also supports streamable HTTP transport in version 0.2.0, alongside the default stdio transport.
Can it scan my servers for vulnerabilities?
No. It performs lookups against public intelligence APIs only and does not probe your infrastructure. For dependency checking it scans package names and versions against OSV.dev, which is data lookup, not network scanning.
How is this different from just asking Claude about a CVE?
Without tools, Claude answers from training data, which goes stale fast in security. With this server, Claude queries live sources like NVD, EPSS, and CISA KEV, then combines them into a scored, evidence-backed recommendation. The difference is current data plus a transparent formula.
Is my data sent anywhere besides the lookup APIs?
According to the README, traffic is outbound HTTPS only, with no inbound ports and no telemetry. Query terms go to the relevant APIs, responses are cached locally, and keys and payloads are never written to the audit log.
Where do I start?
Clone mukul975/cve-mcp-server, install it, add it to Claude, and try the zero-key question from the README: ask whether a well-known CVE is actively exploited, then check the evidence trail behind the answer. If the score makes sense, add a free NVD key for 10 times the lookup throughput.
The Bottom Line
CVE triage is a correlation problem, and correlation is exactly what an AI assistant with the right tools is good at. CVE MCP Server gives Claude those tools: 28 of them, across 24 sources, with a published scoring formula and a one-call orchestrator that turns a vague worry ("should we patch this?") into a ranked answer. Start with the free tools, add keys as you need them, and let the evidence trail, not the hype, decide what gets patched first.
Read this article in Indonesian: CVE MCP Server: Ubah Claude Menjadi Analis CVE Otomatis.