{
  "markdown": "# Cybersecurity Vulnerability Intelligence MCP Server\n\nUnified vulnerability intelligence from 4 government data sources in a single MCP server. Get enriched CVE lookups with CVSS scores, active exploitation status, exploitation probability, and ATT&CK techniques in one call.\n\n| Source | What It Provides | Update Frequency |\n|--------|-----------------|-----------------|\n| **NIST NVD 2.0** | CVE details, CVSS scores, descriptions, references, CWE classifications | Continuous |\n| **CISA KEV** | Actively exploited vulnerabilities catalog, remediation deadlines | Daily |\n| **FIRST.org EPSS** | Exploitation probability scores (0-1) predicting likelihood of exploitation in next 30 days | Daily |\n| **MITRE ATT&CK** | Adversary techniques mapped to CVEs | Quarterly |\n\n## Tools\n\n### `vuln_lookup_cve` — Enriched CVE Lookup\n\nThe killer feature. Look up any CVE and get intelligence from all 4 sources in a single call.\n\n- **Input:** `{ cveId: \"CVE-2021-44228\" }`\n- **Returns:** NVD details + CVSS score + KEV exploitation status + EPSS probability + ATT&CK techniques\n\n### `vuln_search` — Search CVEs\n\nSearch the NVD by keyword, severity, and date range. Optionally filter to only actively exploited (KEV) vulnerabilities.\n\n- **Input:** `{ keyword: \"apache log4j\", severity: \"CRITICAL\", hasKev: true, limit: 20 }`\n\n### `vuln_kev_latest` — Recently Exploited Vulnerabilities\n\nGet vulnerabilities recently added to CISA's Known Exploited Vulnerabilities catalog.\n\n- **Input:** `{ days: 7, limit: 20 }`\n\n### `vuln_kev_due_soon` — Upcoming Remediation Deadlines\n\nGet KEV entries with remediation deadlines approaching. Critical for federal compliance.\n\n- **Input:** `{ days: 14, limit: 20 }`\n\n### `vuln_epss_top` — Highest Exploitation Probability\n\nGet CVEs most likely to be exploited in the next 30 days based on EPSS machine learning model.\n\n- **Input:** `{ threshold: 0.7, limit: 20 }`\n\n### `vuln_trending` — Newly Published Critical CVEs\n\nGet recently published high/critical severity CVEs from the NVD.\n\n- **Input:** `{ days: 3, severity: \"CRITICAL\", limit: 20 }`\n\n### `vuln_by_vendor` — Vendor Vulnerability Assessment\n\nSearch CVEs for a specific vendor/product. Cross-references with CISA KEV to flag actively exploited issues.\n\n- **Input:** `{ vendor: \"microsoft\", product: \"windows\", limit: 20 }`\n\n## Use Cases\n\n- **Vulnerability triage**: Look up a CVE and instantly know if it's actively exploited, its EPSS score, and what ATT&CK techniques apply\n- **Patch prioritization**: Combine KEV status + EPSS scores to prioritize remediation\n- **Compliance tracking**: Monitor upcoming CISA KEV remediation deadlines\n- **Threat intelligence**: Track trending CVEs and newly weaponized vulnerabilities\n- **Vendor risk assessment**: Assess a vendor's vulnerability exposure and active exploitation status\n\n## Quick Start\n\n### Glama (hosted)\n\nInstall from [Glama.ai](https://glama.ai/mcp/servers/cybersecurity-vuln-mcp).\n\n### Apify (hosted)\n\n```json\n{\n  \"mcpServers\": {\n    \"cybersecurity\": {\n      \"url\": \"https://cybersecurity-vuln-mcp.apify.actor/mcp\"\n    }\n  }\n}\n```\n\n### Claude Desktop / Claude Code\n\n```json\n{\n  \"mcpServers\": {\n    \"cybersecurity\": {\n      \"command\": \"node\",\n      \"args\": [\"path/to/servers/cybersecurity-vuln-mcp/dist/stdio.js\"],\n      \"env\": {\n        \"NVD_API_KEY\": \"your-key-here\"\n      }\n    }\n  }\n}\n```\n\n### Local (stdio)\n\n```bash\ngit clone https://github.com/martc03/gov-mcp-servers.git\ncd gov-mcp-servers/servers/cybersecurity-vuln-mcp\nnpm install && npm run build\nnode dist/stdio.js\n```\n\n## Environment Variables\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `NVD_API_KEY` | No | NVD API key for higher rate limits (50 req/30s vs 5 req/30s). [Register here](https://nvd.nist.gov/developers/request-an-api-key). |\n\n## Caching\n\n| Data Source | TTL | Notes |\n|-------------|-----|-------|\n| NVD CVE lookups | 1 hour | Per-CVE |\n| CISA KEV catalog | 2 hours | Full catalog |\n| EPSS scores | 24 hours | Per-CVE |\n| ATT&CK mappings | Static | Bundled with server |\n\n## Architecture\n\n- **Protocol**: MCP over stdio (Glama/local) or Streamable HTTP (Apify)\n- **Runtime**: Node.js 18+, TypeScript\n- **Data**: Direct API calls to free government data sources, zero cost\n- **Caching**: In-memory with configurable TTLs\n\n## Other Servers in This Repo\n\nThis repository contains 13 MCP servers for US government data. See each server's README for details.\n\n| Server | Tools | Data Sources |\n|--------|-------|--------------|\n| [us-safety-recalls-mcp](servers/us-safety-recalls-mcp) | 4 | NHTSA recalls, FDA recalls |\n| [natural-disaster-intel-mcp](servers/natural-disaster-intel-mcp) | 4 | FEMA disasters, NOAA weather, USGS earthquakes |\n| [federal-financial-intel-mcp](servers/federal-financial-intel-mcp) | 4 | SEC EDGAR, CFPB complaints, BLS employment |\n| [immigration-travel-mcp](servers/immigration-travel-mcp) | 3 | Visa bulletins, border wait times |\n| [environmental-compliance-mcp](servers/environmental-compliance-mcp) | 3 | EPA air quality, HUD foreclosures |\n| [gov-contracts-mcp](servers/gov-contracts-mcp) | 4 | SAM.gov contracts, USAspending |\n| [court-records-mcp](servers/court-records-mcp) | 4 | PACER, federal court records |\n| [public-health-mcp](servers/public-health-mcp) | 4 | NIH clinical trials, FDA adverse events |\n| [business-entity-mcp](servers/business-entity-mcp) | 4 | SEC company search, SBA resources |\n| [regulatory-monitor-mcp](servers/regulatory-monitor-mcp) | 4 | Federal Register, regulations.gov |\n| [grant-finder-mcp](servers/grant-finder-mcp) | 4 | Grants.gov, USAspending |\n| [competitive-intel-mcp](servers/competitive-intel-mcp) | 4 | SEC filings, patent data, trade data |\n\nA [REST API gateway](gateway/) with 45 endpoints is also available at `govdata-api.netlify.app`.\n\n## Attribution\n\n- NVD: This product uses data from the NVD API but is not endorsed or certified by the NVD.\n- EPSS: Data provided by FIRST.org (https://www.first.org/epss/).\n- ATT&CK: Registered trademark of The MITRE Corporation. Licensed under Apache 2.0.\n- KEV: CISA Known Exploited Vulnerabilities Catalog, US Government public domain.\n\n## Custom MCP Server Development\n\nNeed a custom MCP server for your business? Visit [mcpdev.netlify.app](https://mcpdev.netlify.app) or email codee.mcpdev@gmail.com.\n\n## License\n\nMIT\n",
  "bytes": 6295,
  "sha": "f0bf40ecf9d495c86b817c7cb2476b9124f1e40ce68478a9610d05fbd8c8e451",
  "repo_slug": "martc03/gov-mcp-servers",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_martc03_competitive_intel_9f05c7b3/readme"
}