mcp server
cve-intelligence
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Description as published by the maintainer. Source
- version 1.3.0
- active
- retrieval
- security
active — Registry entry last updated 2026-08-03. Dashed tags are derived by ZBS Index from the published description, not stated by the maintainer.
What this server can do
5 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.
get_cve(id)- Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities plus the Sigma log-detection layer, per-product fixed versions (fixed = first patched build; affected_through = last VULNERABLE build, never a fix), news/community coverage, intelligence summary. No key required over MCP; an API key on the HTTP request (Authorization: Bearer cvs_live_…) is honoured for attribution. Absence semantics: a null field means this dataset holds no such record, never that none exists. Required: id.
get_scoreboard- The Defender Scoreboard report (CC BY 4.0): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change notes. Cite as "CVE Security Defender Scoreboard, cve-security.com/scoreboard".
get_updates(type, limit, since, cursor)- The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue. Events for withdrawn CVE ids are omitted.
query_package(name, purl, ecosystem)- CVEs affecting one open-source package, by purl (pkg:npm/lodash) or ecosystem + name (Maven names are group:artifact). Returns the CVE list KEV-first with each OSV version range VERBATIM: `events` plus one render-safe projection — `fixed` (the upgrade targets) or `affected_through` (the last VULNERABLE version, never a fix). This tool does NOT evaluate version membership — compare versions on your side with your ecosystem’s own semantics. Covers CVE-linked, GitHub-reviewed OSS advisories via OSV.dev; absence is not evidence of safety.
search_cves(q, cwe, eco, fix, kev, pkg, sev, page, year, limit, detect, vendor, epss_gte, ransomware)- Search the catalog. Free text (q) and/or structured filters: vendor (slug), cwe (CWE-nnn), year ("2024,2025"), sev ("critical,high"), kev (0|1), ransomware (0|1), detect (0|1 — detection content we track), fix (0|1 — fix=0 means computed-and-none-held, never "no fix exists"), epss_gte (0..1), eco (OSS ecosystem, e.g. npm or PyPI), pkg (pkg_key, e.g. npm/lodash — for ranges use query_package), page, limit (1..50). Filter-only queries return the /browse slice ordered KEV-first then EPSS.
Last successful function declaration observed on . Source: https://cve-security.com/api/mcp. We list what the server declared; we do not call any of these functions.
Endpoint status observed on . Source: https://cve-security.com/api/mcp.
Signals
These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.
| Signal | Value | What it measures | Window | Observed | Source |
|---|---|---|---|---|---|
| Latest published version | 1.3.0 | Latest version string the maintainer published to the registry. | as of fetch | Model Context Protocol | |
| Registry record last updated | 2026-08-03 | When the registry record was last updated by its maintainer. | point in time | Model Context Protocol | |
| First listed in the MCP Registry | 2026-08-03 | Date this server was first published to the official MCP Registry. Not a usage or quality measure. | point in time | Model Context Protocol | |
| mcp tools declared | 5 tools | Number of functions the server itself declared when asked to list them. This is what the server offers an agent, not a measure of how well any of them work. | as of probe | cve-security.com | |
| mcp endpoint status | ok | The server listed 5 functions when asked. | as of probe | cve-security.com |
Where to get it
This record as data
Every field on this page, with its source and observation date, is in the catalog JSON. Fetch the whole kind at once instead of parsing this HTML.
GET /api/v1/entries/mcp_server.json