Security Intel MCP

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Security Intel MCP": {
      "url": "https://security.datakoot.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (5)

• cve_lookup read-only

  Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.

  Parameters:

  • cve_id (required) — string — CVE identifier, e.g. CVE-2021-44228 (case-insensitive; a bare 2021-44228 also works).

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• known_exploited read-only

  Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.

  Parameters:

  • limit — number — When listing, how many newest entries to return (default 20, max 100).
  • cve_id — string — Optional. Check a single CVE, e.g. CVE-2021-44228.
  • vendor — string — Optional. Filter by vendor or product name substring.
  • ransomware_only — boolean — Optional. Only vulns CISA links to known ransomware campaigns.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• epss_score read-only

  Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.

  Parameters:

  • cve_id — string — A single CVE id.
  • cve_ids — array — Multiple CVE ids (or pass a comma-separated string).

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• package_vulnerabilities read-only

  List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.

  Parameters:

  • ecosystem (required) — string — Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
  • name (required) — string — Exact package name as published in that registry, e.g. lodash for npm, requests for pypi.
  • version — string — Optional; if given, only vulns affecting that version are returned

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• audit_dependencies read-only

  Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.

  Parameters:

  • manifest — string — Raw package.json contents
  • ecosystem — string — Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex.
  • dependencies — array — [{name, version}] entries

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.