cve-mcp-server

cve-mcp-server is an MCP server, listed under version control. It reaches abuseipdb, github, greynoise, nvd, shodan, urlscan, virustotal and vulncheck. It needs ABUSEIPDB_KEY, GITHUB_TOKEN, GREYNOISE_API_KEY, NVD_API_KEY, SHODAN_KEY, URLSCAN_KEY, VIRUSTOTAL_KEY and VULNCHECK_TOKEN to authenticate. Its repository has 1,633 GitHub stars and is licensed under Apache-2.0; we last read it on 2026-10-22.

cve-mcp-server provides a production-grade MCP server with 27 security intelligence tools accessible via 21 APIs, including CVE lookup, EPSS scoring, CISA KEVs, MITRE ATT&CK, Shodan, and VirusTotal.

Read from cve-mcp-server’s own README, close to verbatim -- not written by us, and not guessed.

pip install cve-mcp-server

26 tools documented in its README. An AI client calls these by name.

search_cves

No description in the README.

get_epss_score

Get EPSS exploitation probability (0–1) and percentile for one or more CVEs. **API Key Required:** Free / No key **Example Usage:** `get_epss_score("CVE-2024-3400")`

check_kev_status

Check whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog. **API Key Required:** Free / No key **Example Usage:** `check_kev_status("CVE-2021-44228")`

get_cvss_details

Parse and explain a CVSS v3.1 vector string with per-metric breakdown. **API Key Required:** Free / No key **Example Usage:** `get_cvss_details("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H")`

get_cwe_info

Look up Common Weakness Enumeration details by CWE ID from embedded database. **API Key Required:** Free / No key **Example Usage:** `get_cwe_info("CWE-79")`

get_cve_references

Extract and categorize all reference links for a CVE (patches, advisories, exploits). **API Key Required:** Free / No key (key recommended) **Example Usage:** `get_cve_references("CVE-2023-44487")`

bulk_cve_lookup

Batch-fetch details for up to 20 CVEs in a single call with parallel enrichment. **API Key Required:** Free / No key (key recommended) **Example Usage:** `bulk_cve_lookup(["CVE-2024-3400", "CVE-2023-4

search_exploits

Search GitHub for public proof-of-concept exploits and exploit code repositories. **API Key Required:** `GITHUB_TOKEN` (optional) **Example Usage:** `search_exploits("CVE-2024-3400")`

get_mitre_techniques

Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations. **API Key Required:** Free / No key **Example Usage:** `get_mitre_techniques("CVE-2021-44228")`

check_poc_availability

Determine if known proof-of-concept code exists for a CVE across multiple sources. **API Key Required:** `GITHUB_TOKEN` (optional) **Example Usage:** `check_poc_availability("CVE-2024-3400")`

get_attack_patterns

Retrieve CAPEC attack pattern details associated with a CWE or CVE. **API Key Required:** Free / No key **Example Usage:** `get_attack_patterns("CWE-89")`

calculate_risk_score

Compute composite 0–100 risk score using CVSS, EPSS, KEV status, and PoC availability. **API Key Required:** Free / No key (key recommended) **Example Usage:** `calculate_risk_score("CVE-2024-3400")`

generate_risk_report

Generate a formatted executive security report for one or more CVEs with recommendations. **API Key Required:** Free / No key (key recommended) **Example Usage:** `generate_risk_report(["CVE-2024-3400

prioritize_cves

Rank a list of CVEs by composite risk score for triage prioritization. **API Key Required:** Free / No key (key recommended) **Example Usage:** `prioritize_cves(["CVE-2024-3400", "CVE-2023-4966", "CVE

get_trending_cves

Retrieve trending CVEs based on high EPSS scores and recent KEV additions. **API Key Required:** Free / No key **Example Usage:** `get_trending_cves(days=7, min_epss=0.5)`

lookup_ip_reputation

Check IP address abuse history and confidence score via AbuseIPDB. **API Key Required:** `ABUSEIPDB_API_KEY` **Example Usage:** `lookup_ip_reputation("185.220.101.34")`

check_ip_noise

Query GreyNoise for IP scan/attack activity, classification, and associated CVEs. **API Key Required:** `GREYNOISE_API_KEY` **Example Usage:** `check_ip_noise("185.220.101.34")`

shodan_host_lookup

Get open ports, services, banners, and vulnerabilities for an IP via Shodan. **API Key Required:** `SHODAN_API_KEY` **Example Usage:** `shodan_host_lookup("8.8.8.8")`

passive_dns_lookup

Retrieve historical DNS resolution data for a domain from CIRCL Passive DNS. **API Key Required:** `CIRCL_PDNS_USER` + `CIRCL_PDNS_PASSWORD` **Example Usage:** `passive_dns_lookup("example.com")`

virustotal_lookup

Analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines. **API Key Required:** `VIRUSTOTAL_API_KEY` **Example Usage:** `virustotal_lookup(hash="44d88612fea8a8f36de82e1278abb02f")`

search_malware

Search MalwareBazaar for malware samples by hash, tag, or signature. **API Key Required:** `ABUSECH_AUTH_KEY` (optional) **Example Usage:** `search_malware(tag="Emotet")`

search_iocs

Query ThreatFox for Indicators of Compromise linked to malware families. **API Key Required:** `ABUSECH_AUTH_KEY` (optional) **Example Usage:** `search_iocs(malware="CobaltStrike")`

check_ransomware

Look up ransomware payment addresses and transaction data from Ransomwhere. **API Key Required:** Free / No key **Example Usage:** `check_ransomware(address="bc1q...")`

scan_dependencies

Scan package names and versions against OSV.dev for known vulnerabilities. **API Key Required:** Free / No key **Example Usage:** `scan_dependencies(ecosystem="PyPI", packages={"requests": "2.28.0"})`

scan_github_advisories

Search GitHub Security Advisories by ecosystem, package, or severity. **API Key Required:** `GITHUB_TOKEN` (optional) **Example Usage:** `scan_github_advisories(ecosystem="pip", package="django")`

urlscan_check

Submit a URL for scanning or retrieve previous scan results from URLScan.io. **API Key Required:** `URLSCAN_API_KEY` **Example Usage:** `urlscan_check("https://suspicious-site.com")`

Read from the README; names are kept only if the README contains them.

Ranked by services in common with cve-mcp-server, then by stars. Figures are from each repository when we last read it.

What does cve-mcp-server do?

cve-mcp-server provides a production-grade MCP server with 27 security intelligence tools accessible via 21 APIs, including CVE lookup, EPSS scoring, CISA KEVs, MITRE ATT&CK, Shodan, and VirusTotal.

How do I install cve-mcp-server?

Its own README gives this command: pip install cve-mcp-server. Run it where your MCP client can launch the server, and check the README for any settings it asks for.

What does cve-mcp-server connect to, and what does it need?

It reaches abuseipdb, github, greynoise, nvd, shodan, urlscan, virustotal and vulncheck. The credentials we found in its source are ABUSEIPDB_KEY, GITHUB_TOKEN, GREYNOISE_API_KEY, NVD_API_KEY, SHODAN_KEY, URLSCAN_KEY, VIRUSTOTAL_KEY and VULNCHECK_TOKEN.

Is cve-mcp-server official and is it maintained?

We found nothing naming it as a vendor’s official server. Its repository has 1,633 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-01.

What licence does cve-mcp-server use?

The repository declares the Apache-2.0 licence.

• mcp-proxy2,805 stars
• idea-reality-mcp828 stars
• anythingmcp775 stars
• RepoMapper217 stars
• gitlab-mr-mcp94 stars
• MarkuprPlus80 stars

All version control entries →

• Introduction to Model Context Protocol (Claude Academy)
• The Hugging Face MCP course
• Build an AI agent: a path with skills and MCP servers to practise on