CVE Risk

Provides CVE lookups, KEV enrichment, and patch-priority scoring with batch ranking for patch queues.

python

0

GitHub Stars

python

Language

4 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "sarveshkapre-cve-risk-mcp": {
      "command": "python",
      "args": [
        "-m",
        "cve_risk_mcp",
        "--stdio"
      ]
    }
  }
}

You run a lightweight MCP server focused on CVE lookups, KEV enrichment, and prioritization to help you decide what to patch first. It exposes several tools through the standard MCP flow and returns structured risk assessments for each CVE, enabling batch ranking and streamlined patch planning.

How to use

To use this MCP server, connect with an MCP client using the standard tools/list and tools/call flow over stdio. You can perform individual lookups, rank multiple CVEs by risk, or generate patch-first recommendations. The server returns CVSS-based risk scores, KEV enrichment when available, and, for EPSS-like scoring, reasons and priority labels to help you triage vulnerabilities in your environment.

How to install

Prerequisites: ensure Python is installed on your system and you have a working shell. You will run the MCP server directly via Python. You can also prepare a quick test with the provided build steps.

make setup
make check

Start the MCP server in stdio mode with the following command. This runs the server as a local process that communicates through standard input and output.

python -m cve_risk_mcp --stdio

Additional information

This server supports several tools to help you manage CVE data and patch planning. It uses data sources for CVE details, KEV enrichment, and optional EPSS-style risk scoring. It provides reliability knobs to handle transient failures and includes structured error data for upstream issues.

Key data sources include the CIRCL CVE data feed for vulnerability details, the CISA Known Exploited Vulnerabilities feed for KEV enrichment (with a mirror fallback), and an optional FIRST EPSS API for risk scoring.

If you need to revalidate cache or refresh CVEs, you can use the provided status and refresh operations to monitor upstream status and cache health.

Notes

No authentication is required for local or controlled environments. All outbound network calls use GET requests to the configured APIs. The server tolerates legacy CVE schema variants and includes remediation hints for retry strategies when encountering 429 errors.

Available tools

cve_lookup

Inputs: cve_id, include_kev, include_epss. Output: CVE summary, KEV status, and risk score.

cve_rank

Inputs: cve_ids, include_kev, include_epss. Output: ranked list with highest risk first.

cve_patch_first

Inputs: cve_ids, top_n, include_kev, include_epss. Output: ranked list with top-N recommendations.

cve_status

Inputs: none. Output: upstream status and cache statistics including timestamps and last error summary.

cve_refresh

Inputs: cve_ids, include_epss, refresh_kev. Output: cache warm/refresh summary.

cve_export

Inputs: cve_ids, include_kev, include_epss, include_markdown. Output: ranked list with optional markdown summary.