Security Intel MCP
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Should I use this
Quality & Safety
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"cve-vulnerability-lookup": {
"url": "https://security.datakoot.com/mcp"
}
}
}Remote endpoints
https://security.datakoot.com/mcpstreamable-httpWhat it can do
Tool inventory
Tools (5)
🟢cve_lookup(cve_id)
Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.
Input Schema
{
"type": "object",
"properties": {
"cve_id": {
"type": "string",
"description": "CVE identifier, e.g. CVE-2021-44228 (case-insensitive; a bare 2021-44228 also works)."
}
},
"required": [
"cve_id"
]
}Output Schema
{
"type": "object",
"properties": {
"id": {},
"status": {},
"description": {},
"cvss": {},
"cwe": {},
"published": {},
"last_modified": {},
"references": {},
"known_exploited": {},
"exploit_probability": {},
"sources": {},
"provenance": {
"type": "object",
"description": "Where this answer came from. served_at is when Datakoot answered (UTC); upstream lists the official sources consulted. Datakoot may serve a briefly cached copy, so the source's own observation can be older than served_at.",
"properties": {
"served_at": {
"type": "string",
"format": "date-time"
},
"upstream": {
"type": "array",
"items": {
"type": "string"
}
},
"publisher": {
"type": "string"
},
"may_be_cached": {
"type": "boolean"
}
}
}
},
"additionalProperties": true
}🟢known_exploited(cve_id, limit, vendor, ransomware_only)
Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.
Input Schema
{
"type": "object",
"properties": {
"cve_id": {
"type": "string",
"description": "Optional. Check a single CVE, e.g. CVE-2021-44228."
},
"limit": {
"type": "number",
"description": "When listing, how many newest entries to return (default 20, max 100)."
},
"vendor": {
"type": "string",
"description": "Optional. Filter by vendor or product name substring."
},
"ransomware_only": {
"type": "boolean",
"description": "Optional. Only vulns CISA links to known ransomware campaigns."
}
},
"required": []
}Output Schema
{
"type": "object",
"properties": {
"catalog_version": {},
"catalog_count": {},
"released": {},
"returned": {},
"filter": {},
"vulnerabilities": {},
"source": {},
"cve_id": {},
"listed": {},
"vendor": {},
"product": {},
"name": {},
"date_added": {},
"due_date": {},
"known_ransomware_use": {},
"required_action": {},
"provenance": {
"type": "object",
"description": "Where this answer came from. served_at is when Datakoot answered (UTC); upstream lists the official sources consulted. Datakoot may serve a briefly cached copy, so the source's own observation can be older than served_at.",
"properties": {
"served_at": {
"type": "string",
"format": "date-time"
},
"upstream": {
"type": "array",
"items": {
"type": "string"
}
},
"publisher": {
"type": "string"
},
"may_be_cached": {
"type": "boolean"
}
}
}
},
"additionalProperties": true
}🟢epss_score(cve_id, cve_ids)
Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.
Input Schema
{
"type": "object",
"properties": {
"cve_id": {
"type": "string",
"description": "A single CVE id."
},
"cve_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Multiple CVE ids (or pass a comma-separated string)."
}
},
"required": []
}Output Schema
{
"type": "object",
"properties": {
"model": {},
"as_of": {},
"scored": {},
"scores": {},
"note": {},
"source": {},
"provenance": {
"type": "object",
"description": "Where this answer came from. served_at is when Datakoot answered (UTC); upstream lists the official sources consulted. Datakoot may serve a briefly cached copy, so the source's own observation can be older than served_at.",
"properties": {
"served_at": {
"type": "string",
"format": "date-time"
},
"upstream": {
"type": "array",
"items": {
"type": "string"
}
},
"publisher": {
"type": "string"
},
"may_be_cached": {
"type": "boolean"
}
}
}
},
"additionalProperties": true
}🟢package_vulnerabilities(ecosystem, name, version)
List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
Input Schema
{
"type": "object",
"properties": {
"ecosystem": {
"type": "string",
"description": "Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex."
},
"name": {
"type": "string",
"description": "Exact package name as published in that registry, e.g. lodash for npm, requests for pypi."
},
"version": {
"type": "string",
"description": "Optional; if given, only vulns affecting that version are returned"
}
},
"required": [
"ecosystem",
"name"
]
}Output Schema
{
"type": "object",
"properties": {
"ecosystem": {},
"name": {},
"version": {},
"vulnerability_count": {},
"vulnerabilities": {},
"source": {},
"provenance": {
"type": "object",
"description": "Where this answer came from. served_at is when Datakoot answered (UTC); upstream lists the official sources consulted. Datakoot may serve a briefly cached copy, so the source's own observation can be older than served_at.",
"properties": {
"served_at": {
"type": "string",
"format": "date-time"
},
"upstream": {
"type": "array",
"items": {
"type": "string"
}
},
"publisher": {
"type": "string"
},
"may_be_cached": {
"type": "boolean"
}
}
}
},
"additionalProperties": true
}🟢audit_dependencies(manifest, dependencies, ecosystem)
Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
Input Schema
{
"type": "object",
"properties": {
"manifest": {
"type": "string",
"description": "Raw package.json contents"
},
"dependencies": {
"type": "array",
"items": {
"type": "object"
},
"description": "[{name, version}] entries"
},
"ecosystem": {
"type": "string",
"description": "Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex."
}
},
"required": []
}Output Schema
{
"type": "object",
"properties": {
"ecosystem": {},
"packages_audited": {},
"packages_with_vulnerabilities": {},
"total_vulnerabilities": {},
"packages_not_found": {},
"packages_unverified": {},
"verdict": {},
"findings": {},
"source": {},
"provenance": {
"type": "object",
"description": "Where this answer came from. served_at is when Datakoot answered (UTC); upstream lists the official sources consulted. Datakoot may serve a briefly cached copy, so the source's own observation can be older than served_at.",
"properties": {
"served_at": {
"type": "string",
"format": "date-time"
},
"upstream": {
"type": "array",
"items": {
"type": "string"
}
},
"publisher": {
"type": "string"
},
"may_be_cached": {
"type": "boolean"
}
}
}
},
"additionalProperties": true
}Community
Evidence