CVE

You can deploy and operate a CVE detection-to-remediation fabric server that scans managed repositories, enriches vulnerability data, triages findings, and automatically creates fixes across your projects. This MCP provides end-to-end automation for identifying, prioritizing, and addressing CVEs within your codebase ecosystems.

How to use

You run the CVE MCP server locally or from a client that supports MCP servers. Start the server with the standard MCP runtime, provide your authentication and scope details, and your client can trigger scans, enrich CVEs from NVD, apply policy-based triage, and push fixes back into your repos.

How to install

Prerequisites you need before starting this MCP server are Node.js and npm. You will run the server using a lightweight CLI in your environment.

# Prerequisites
node -v
npm -v

# Install and start the CVE MCP server via NPX (example)
export GITHUB_TOKEN="ghp_..."
export STATE_REPO="ry-ops/git-steer-state"
export MANAGED_REPOS="ry-ops/git-steer,ry-ops/blog"

npx @git-fabric/cve start
```}]} ,{

If you prefer a desktop configuration, you can run the MCP server through a client configuration that launches the same runtime. The configuration below shows how to invoke the server with NPX and pass the required environment variables.

Additional configuration and notes

Environment variables you need to supply include your GitHub token, the state repository path, and the list of managed repositories. These values enable the server to scan dependencies, enrich CVEs, and queue remediation actions.

The server supports an autonomous workflow across layers: Detection, Intelligence, Decision, Action, and State. Your configuration determines how aggressively you want to triage and auto-create pull requests for fixes.

Example workflow steps you can observe in practice: scan repositories for vulnerable dependencies, enrich CVEs with CVSS data from NVD, triage pending items against your severity policy, and automatically create PRs for high-severity findings.

Usage details from commands and configurations

The server is designed to be invoked through a standard MCP client that can start the server with NPX and the package name, followed by the start command. Below are representative commands you can use in your environment.

Project structure

The project is organized into layers that perform scanning, enrichment, decision making, actions, and state management. Core code is in TypeScript and includes adapters for environment configuration and MCP server orchestration.

Security and reliability

Ensure your GitHub token and state repository access are secured. Use least-privilege tokens and rotate credentials as part of your security practices. The system writes state changes and queue updates to your state repository, so restrict write access accordingly.

Troubleshooting notes

If you encounter failures starting the server, verify that your environment variables are correctly set and accessible to the runtime. Check that the managed repositories exist and that your GitHub token has the required scopes to read dependencies, create/PRs, and manage workflows.

Notes

The CVE MCP integrates with GitHub actions and supports a queue-based workflow to manage remediation tasks. You can fine-tune triage behavior with policy settings and command-line flags when operating the MCP client.

Available tools

cve_scan

Scan managed repositories for vulnerable dependencies by querying the GitHub Advisory Database (GHSA) and reporting findings.

cve_enrich

Fetch enriched CVE details from the NVD, including CVSS scores and CWE mappings.

cve_batch

Batch enrich and rank multiple CVEs by severity to streamline triage.

cve_triage

Process pending queue entries according to policy and generate remediation plans.

cve_queue_list

List queue entries filtered by status and severity to monitor progress.

cve_queue_stats

Provide a health dashboard for the CVE queue and processing pipeline.

cve_queue_update

Manually update entry status or mark items to skip with reasons.