{
  "markdown": "# purify-feeds-mcp\n\nMCP server for Purify's production security-intelligence feeds. Lets Claude\nDesktop, Cursor and other MCP clients query live CISA KEV / EPSS / enriched\nvulnerability feeds — every answer carries an auditable feed version and full\nper-record provenance.\n\nThe feeds behind this server are continuously scheduled, quality-gated and\nself-healing. Each record ships with a `_purify` data passport: where it was\nfetched from, when, with which extractor, and the hash of the raw artifact it\ncame from.\n\n## Tools\n\n| Tool | Purpose |\n|---|---|\n| `list_feeds` | List feeds with record counts and current version (dataset artifact hash) |\n| `search_feed` | AND filters / sort / up to 50 rows, plus an exact `total_matched` count |\n| `get_provenance` | Return a record's `_purify` passport and the feed's run chain, by CVE id |\n| `check_feed_changed` | Incremental primitive: compare a known hash to detect new feed versions |\n\n## Feeds\n\n| Name | Contents |\n|---|---|\n| `kev` | CISA Known Exploited Vulnerabilities catalog |\n| `epss` | EPSS high-risk slice (exploit prediction scores) |\n| `enriched` | EPSS + KEV joined view with risk bands |\n\n## Install\n\n```bash\ngo install github.com/eason4kim-rocket/purify-feeds-mcp@latest\n```\n\nOr use the Docker image (no Go toolchain needed):\n\n```bash\ndocker pull ghcr.io/eason4kim-rocket/purify-feeds-mcp:latest\n```\n\nOr build from source:\n\n```bash\ngit clone https://github.com/eason4kim-rocket/purify-feeds-mcp\ncd purify-feeds-mcp && go build .\n```\n\n## Configure (Claude Desktop)\n\n`~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"purify-feeds\": {\n      \"command\": \"/path/to/purify-feeds-mcp\",\n      \"env\": {\n        \"PURIFY_API_URL\": \"https://feeds.verifly.pro/feeds-api\",\n        \"PURIFY_API_KEY\": \"<your-api-key>\"\n      }\n    }\n  }\n}\n```\n\nOr with Docker (the image defaults `PURIFY_API_URL` to the public gateway):\n\n```json\n{\n  \"mcpServers\": {\n    \"purify-feeds\": {\n      \"command\": \"docker\",\n      \"args\": [\"run\", \"-i\", \"--rm\", \"-e\", \"PURIFY_API_KEY\",\n               \"ghcr.io/eason4kim-rocket/purify-feeds-mcp:latest\"],\n      \"env\": { \"PURIFY_API_KEY\": \"<your-api-key>\" }\n    }\n  }\n}\n```\n\nThe public gateway is read-only (GET only, feed whitelist, per-key rate\nlimits). Health check: `https://feeds.verifly.pro/healthz` — no key needed.\nAPI keys are issued manually during the pilot — open an issue or\ncontact the maintainer to get one.\n\n## Environment variables\n\n- `PURIFY_API_URL` — feeds API base URL (default `http://127.0.0.1:8091` for local/dev use)\n- `PURIFY_API_KEY` — API key, sent as a bearer token (required for the public gateway)\n- `PURIFY_FEEDS` — override the built-in feed table: `name=spec_id,...`\n\n## Example prompts\n\n- \"Which CVEs entered CISA KEV in the last 7 days? Give vendors and remediation due dates.\"\n- \"How many CVEs have EPSS > 0.99 and are in KEV? Top 5?\"\n- \"Where does the data for CVE-2026-45659 come from?\" (`get_provenance` returns the full passport)\n- Agent loops: remember `artifact_hash`, call `check_feed_changed` first on the\n  next run, and only re-triage when the feed actually changed.\n\n## License\n\nMIT\n",
  "bytes": 3148,
  "sha": "097477bbbec7592f0826bc6b27f4d95b983cd9bbd6818b7429e5ca5e0019f031",
  "repo_slug": "eason4kim-rocket/purify-feeds-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_eason4kim_rocket_purify_feeds__114bf919/readme"
}