MCP Cybersecurity Server

You can run the MCP Cybersecurity Server to query CVEs, assess risk, and follow ready-to-use playbooks. This server integrates CIRCL Vulnerability Lookup and exposes tools for CVE lookup, keyword-based searches, and risk summarization, enabling SOC-ready insights within your MCP client workflow.

How to use

You interact with the server through an MCP client by invoking its available tools in a natural language prompt. The server exposes three main capabilities: looking up a specific CVE, searching CVEs by keyword or product, and generating risk summaries for a set of CVEs. You can also consult a preconfigured playbook and risk matrix resource to structure remediation planning. Use multi-step prompts to analyze multiple CVEs for a given asset and to generate executive reports with remediation timelines.

How to install

Prerequisites: you need Python 3.10 or newer (3.12+ recommended). Your operating system can be macOS, Linux, or Windows. You will run the MCP server locally using a Python virtual environment.

# 1. Clone or download the project to a local path
# Navigate to the project directory
cd "/path/to/mcp-cybersecurity-server"

# 2. Create a virtual environment with Python 3.12+
python3.12 -m venv venv

# Activate the virtual environment
# macOS/Linux:
source venv/bin/activate
# Windows:
venv\Scripts\activate

# 3. Install dependencies
pip install --upgrade pip
pip install -r requirements.txt

Additional sections

Configuration and runtime details are provided to tailor the server to your environment. The server uses CIRCL API base URL configuration and logging level can be adjusted through environment variables.

Configure environment variables to point to CIRCL and to set logging preferences. For example, you can copy an example environment file and adjust CIRCL_API_BASE_URL and LOG_LEVEL as needed.

# Optional: copy example env file
cp .env.example .env

# Edit .env to customize:
# CIRCL_API_BASE_URL=https://vulnerability.circl.lu/api
# LOG_LEVEL=INFO

Server configuration and runtime (MCP client integration)

To connect your MCP client to the cybersecurity server, use the following runtime configuration snippet. This config runs the server locally using a Python virtual environment and launches the MCP server module.

{
  "mcpServers": {
    "cybersecurity": {
      "command": "/RUTA_COMPLETA/mcp-cybersecurity-server/venv/bin/python",
      "args": [
        "-m",
        "src.server"
      ],
      "cwd": "/RUTA_COMPLETA/mcp-cybersecurity-server",
      "env": {
        "CIRCL_API_BASE_URL": "https://vulnerability.circl.lu/api"
      }
    }
  }
}

Available tools

search_cve_by_id

Fetches detailed information for a single CVE including description, CVSS, severity, references, dates, and CWEs.

search_cves_by_keyword

Searches CVEs by product, vendor, or keyword to discover vulnerabilities related to specific technologies.

summarize_cve_risk

Performs SOC-oriented risk analysis for a CVE, providing urgency level, EPSS, SLAs, and mitigation recommendations.