{
  "markdown": "# pg-cve-mcp — PostgreSQL CVE & Release Intelligence for AI Agents\n\n[![PyPI version](https://img.shields.io/pypi/v/pg-cve-mcp.svg)](https://pypi.org/project/pg-cve-mcp/)\n[![Python versions](https://img.shields.io/pypi/pyversions/pg-cve-mcp.svg)](https://pypi.org/project/pg-cve-mcp/)\n[![License](https://img.shields.io/github/license/meob/PG_CVE-MCP.svg)](https://github.com/meob/PG_CVE-MCP/blob/main/LICENSE)\n\n<!-- mcp-name: io.github.meob/pg-cve-mcp -->\n\n**Give your AI assistant direct access to PostgreSQL security intelligence: CVEs, yanked releases, known exploits, and upgrade paths for any version — queried, not browsed.**\n\n---\n\n## Why pg-cve-mcp?\n\nBrowsing a CVE dashboard is a human habit. **Agents need answers, not pages.**\n\n`pg-cve-mcp` turns the curated dataset of the [**PG_CVE**](https://github.com/meob/PG_CVE) project — the same one powering the [PostgreSQL CVE Dashboard](https://meob.github.io/PG_CVE/) — into MCP tools that any AI assistant (opencode, Claude Desktop, etc.) can call directly. What was a static page becomes a first-class, programmatic part of your AI workflow.\n\nUnlike raw NVD feeds, the PG_CVE dataset is **manually curated** to carry the same judgment a careful DBA would apply:\n\n- **Yanked releases** flagged with the real reason (e.g. *\"Data corruption using CONCURRENTLY\"*)\n- **Known exploits** confirmed to exist in the wild\n- **EOL branches** marked, with a synthetic `CVE-EOL-WARNING` (CVSS 10.0) prepended to unsupported reports\n- **Verified CVEs** — no false positives from automated scraping\n\n### What your agent can now do\n\n| Prompt to your agent | Tool used | Result |\n|---|---|---|\n| \"Is PostgreSQL 15.8 safe?\" | `get_cves(\"15.8\")` | EOL/yanked flags, release date, full CVE list sorted by CVSS |\n| \"Compare 16.3 vs 16.4\" | `compare_versions(\"16.3\", \"16.4\")` | fixed / new / still-present CVEs with release dates |\n| \"Should I upgrade from 14.10?\" | `get_upgrade_path(\"14.10\")` | recommended target + the CVEs it fixes + release dates |\n| \"Any known exploits right now?\" | `get_exploits()` | all exploitable CVEs, sorted by CVSS, with release dates |\n| \"What does this database track?\" | `get_summary()` | stats, EOL and yanked-release overview |\n\n### Agent-first design\n\nEvery tool returns **structured JSON**, sorted by CVSS (highest first). Tools flag *yanked* and *EOL* state explicitly on the version metadata, and include **release dates** for every version. `get_upgrade_path` distinguishes a safe **minor** upgrade from a forced **major** one when a branch is at or near end-of-life — so the agent can give advice, not just data.\n\nSee real tool outputs in the [live demo](docs/demo.md).\n\n---\n\n## Quick Start\n\n```bash\npip install pg-cve-mcp\npg-cve-mcp\n```\n\nOr with `npx` (no install):\n\n```bash\nnpx -y pg-cve-mcp\n```\n\n## MCP Tools\n\n| Tool | Description |\n|------|-------------|\n| `get_cves(version)` | Complete security report for a version: EOL/yanked status, release date, stats, CVEs sorted by CVSS (a synthetic `CVE-EOL-WARNING` at 10.0 is prepended for unsupported releases) |\n| `compare_versions(v1, v2)` | Side-by-side CVE comparison (fixed/new/still present) with yanked & EOL flags and release dates |\n| `get_upgrade_path(from_version)` | Recommended upgrade (minor by default; major when EOL or next-to-EOL) with fixed CVEs and release dates |\n| `get_exploits()` | All CVEs with known public exploits, sorted by CVSS, with release dates |\n| `get_summary()` | Overview of the tracked CVE database incl. yanked releases |\n\n## Transports\n\n### stdio (default)\n\nRun locally over stdio for opencode, Claude Desktop, and other stdio MCP clients:\n\n```bash\npip install -e .\npg-cve-mcp\n```\n\n### Streamable HTTP (self-hosted)\n\nFor remote or enterprise deployments, serve the same tools over HTTP. Run\n`python run_server.py` (or build the Dockerfile); the server listens on `$PORT`\n(default 8000) at path `/mcp`:\n\n```bash\npython run_server.py\n# MCP endpoint: http://127.0.0.1:8000/mcp\n```\n\nConfigure any MCP client with the URL, e.g. in `opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"pg-cve-mcp\": {\n      \"type\": \"remote\",\n      \"url\": \"http://127.0.0.1:8000/mcp\"\n    }\n  }\n}\n```\n\n## Configuration\n\n| Env Var | Default | Description |\n|---------|---------|-------------|\n| `PG_CVE_MCP_TTL` | `86400` | Cache TTL in seconds for CVE data |\n| `PG_CVE_MCP_DATA_URL` | `https://meob.github.io/PG_CVE/postgresql_cves.json` | CVE data source URL |\n| `PORT` | `8000` | HTTP port for the Streamable HTTP server (`run_server.py`) |\n\n## Development\n\nRun the test suite and linters:\n\n```bash\npython -m pytest\nruff check src tests\nmypy src\n```\n\n## Data Source\n\nData is fetched from the [PG_CVE](https://github.com/meob/PG_CVE) project's GitHub Pages with local caching. Falls back to a bundled copy if the network is unavailable.\n\n## Example Prompts\n\n> \"What CVEs affect PostgreSQL 16.4?\"\n>\n> \"Is PostgreSQL 15.8 safe to use?\"\n>\n> \"Compare CVEs in 16.3 vs 16.4\"\n>\n> \"What's the upgrade path from PostgreSQL 14.10?\"\n\n## License\n\nApache 2.0\n",
  "bytes": 4980,
  "sha": "0cf881308ed8d72bf054f27931dd30c468d679cd8c561e4971af55ceb90367b5",
  "repo_slug": "meob/pg_cve-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_meob_pg_cve_mcp_056be5f7/readme"
}