🛰️ security-intel-mcp

A Model Context Protocol (MCP) server that gives Claude real vulnerability intelligence — CVE lookup (NVD), EPSS exploit-probability, and CISA KEV status — from free public APIs. No API key required.

📖 What this is

When triaging a vulnerability, three questions matter: what is it, how likely is it to be exploited, and is it already being exploited in the wild? This MCP server answers all three from authoritative free sources, so an AI assistant can prioritize CVEs by real-world risk — not CVSS alone.

Related MCP server: CVE Intelligence MCP Server

🧰 Tools

cve_enrich applies a transparent rule: KEV > high EPSS > high CVSS — the same logic a good vulnerability-management program uses.

⚙️ Install

git clone https://github.com/devsecforge/security-intel-mcp.git
cd security-intel-mcp
pip install -r requirements.txt

▶️ Use with Claude Desktop

Add to your claude_desktop_config.json (see examples/):

{
  "mcpServers": {
    "security-intel": {
      "command": "python",
      "args": ["/absolute/path/to/security-intel-mcp/server.py"]
    }
  }
}

Restart Claude Desktop, then ask: "Enrich CVE-2021-44228 and tell me if I should patch it now." Claude will call cve_enrich and answer with NVD, EPSS, and KEV data.

🧪 Run standalone

python server.py    # starts the MCP server over stdio

🔒 Notes

• Uses public, unauthenticated endpoints; be mindful of NVD rate limits for bulk use.

• Read-only intelligence — the server takes no actions and stores nothing.

🤝 Contributing & License

See CONTRIBUTING.md. MIT © 2026 devsecforge (S. Naz). Original work.