CISA-Threat-Intelligence-MCP-Server

Provides real-time CISA KEV data and threat intelligence via MCP for AI workflows.

python

1

GitHub Stars

python

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "wcoppedge-cisa-threat-intelligence-mcp-server": {
      "command": "python",
      "args": [
        "/path/to/cisa_threat_intel_mcp.py"
      ]
    }
  }
}

You can run a production-ready MCP server that gives AI agents real-time access to CISA KEV data and advanced threat intelligence. This server is designed for cybersecurity professionals who want integrated, policy-compliant threat insights within AI-powered workflows.

How to use

Interact with the CISA KEV MCP server through an MCP client to perform rapid threat intelligence tasks. You can trigger the available tools to search the KEV catalog, analyze threat trends, enrich CVE data with scores and remediation guidance, and retrieve executive statistics. Use the stdio-based server configuration described here to run the Python script locally, then connect your MCP client to it as a local provider.

How to install

Prerequisites you need before starting:

Python 3.8 or newer
Internet connectivity for accessing CISA/NVD APIs
An MCP-compatible client (for example, Claude Desktop)

Step-by-step setup to run the MCP server locally:

Create the Python script for the MCP server and save it as cisa_threat_intel_mcp.py in a convenient location.
Ensure your Python environment has any required dependencies installed for that script.
Configure your MCP client to load the local MCP server using the provided stdio configuration.

Note: The server is designed to be run locally via a Python command and a path to the script. The MCP client will then use the standard IO interface to interact with the server.

Configuration and usage notes

For a local Python-based MCP server, you connect by adding an MCP entry to your client configuration that points to the Python command and the script path. The following configuration shows the exact shape you should use in your MCP client to register the server.

{
  "mcpServers": {
    "cisa_threat_intel": {
      "command": "python",
      "args": ["/path/to/cisa_threat_intel_mcp.py"],
      "env": {}
    }
  }
}

Security and operational notes

This MCP server operates in a stateless manner, fetching data in real time from CISA KEV and NVD APIs as needed. It validates inputs, handles errors gracefully, and adheres to rate-limiting practices to avoid overwhelming external services.

Troubleshooting and tips

If the MCP client cannot connect, verify the Python script path is correct and that the script runs without errors. Check network access to the CISA KEV and NVD APIs, and ensure the client is configured to reach the local stdio interface provided by the Python command.

Examples of common workflows

Daily threat briefing: retrieve KEV statistics, fetch recent KEV entries, and run a threat trend analysis.

Available tools

search_kev_catalog

Search and filter CISA Known Exploited Vulnerabilities data to identify vulnerabilities by vendor, product, or timeframe.

analyze_threat_trends

Perform strategic threat intelligence analysis with patterns such as Trending, Critical, Ransomware, and Recent to identify exploitation trends.

enrich_cve_intelligence

Deep-dive CVE analysis with KEV metadata, NVD enrichment, a custom threat score, and remediation recommendations.

get_kev_statistics

Provide executive-level statistics and strategic insights on KEV data and trends.