A production-grade **Model Context Protocol (MCP) server** that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser
A production-grade Model Context Protocol (MCP) server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs across NVD
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| triage_cve | One-call triage that fans out NVD + EPSS + CISA KEV (+ public PoC for depth != "quick") concurrently, computes the composite risk score with a KEV hard override |
| lookup_cve | Fetch detailed CVE record from NVD including CVSS scores, CWEs, affected products, references, and timeline |
| search_cves | Search NVD for CVEs by keyword, product name, severity, or date range |
| get_epss_score | Get EPSS exploitation probability (0–1) and percentile for one or more CVEs |
| check_kev_status | Check whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog |
| get_cvss_details | Parse and explain a CVSS v3.1 vector string with per-metric breakdown |
| get_cwe_info | Look up Common Weakness Enumeration details by CWE ID from embedded database |
| get_cve_references | Extract and categorize all reference links for a CVE (patches, advisories, exploits) |
| bulk_cve_lookup | Batch-fetch details for up to 20 CVEs in a single call with parallel enrichment |
| search_exploits | Search GitHub for public proof-of-concept exploits and exploit code repositories |
| get_mitre_techniques | Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations |
| check_poc_availability | Determine if known proof-of-concept code exists for a CVE across multiple sources |
| get_attack_patterns | Retrieve CAPEC attack pattern details associated with a CWE or CVE |
| calculate_risk_score | Compute composite 0–100 risk score using CVSS, EPSS, KEV status, and PoC availability |
| generate_risk_report | Generate a formatted executive security report for one or more CVEs with recommendations |
| prioritize_cves | Rank a list of CVEs by composite risk score for triage prioritization |
| get_trending_cves | Retrieve trending CVEs based on high EPSS scores and recent KEV additions |
| lookup_ip_reputation | Check IP address abuse history and confidence score via AbuseIPDB |
| check_ip_noise | Query GreyNoise for IP scan/attack activity, classification, and associated CVEs |
| shodan_host_lookup | Get open ports, services, banners, and vulnerabilities for an IP via Shodan |
| passive_dns_lookup | Retrieve historical DNS resolution data for a domain from CIRCL Passive DNS |
| virustotal_lookup | Analyze file hashes, URLs, domains, or IPs against 70+ antivirus engines |
| search_malware | Search MalwareBazaar for malware samples by hash, tag, or signature |
| search_iocs | Query ThreatFox for Indicators of Compromise linked to malware families |
| check_ransomware | Look up ransomware payment addresses and transaction data from Ransomwhere |
| scan_dependencies | Scan package names and versions against OSV.dev for known vulnerabilities |
| scan_github_advisories | Search GitHub Security Advisories by ecosystem, package, or severity |
| urlscan_check | Submit a URL for scanning or retrieve previous scan results from URLScan.io |
| my_new_tool |
{
"mcpServers": {
"cve-mcp": {
"command": "python",
"args": [
"-m",
"cve_mcp.server"
],
"cwd": "/absolute/path/to/cve-mcp-server",
"env": {
"NVD_API_KEY": "YOUR_NVD_API_KEY",
"GITHUB_TOKEN": "YOUR_GITHUB_TOKEN",
"ABUSEIPDB_KEY": "YOUR_ABUSEIPDB_KEY",
"GREYNOISE_API_KEY": "YOUR_GREYNOISE_API_KEY",
"SHODAN_KEY": "YOUR_SHODAN_KEY"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
| Variable | Description | Required |
|---|---|---|
| NVD_API_KEY | Declared in the maintainer’s client configuration. | Check documentation |
| GITHUB_TOKEN | Declared in the maintainer’s client configuration. | Check documentation |
| ABUSEIPDB_KEY | Declared in the maintainer’s client configuration. | Check documentation |
| GREYNOISE_API_KEY | Declared in the maintainer’s client configuration. | Check documentation |
| SHODAN_KEY | Declared in the maintainer’s client configuration. | Check documentation |
Use Microsoft’s Playwright MCP server to navigate pages, inspect accessibility snapshots, fill forms and capture browser screenshots.
The original Chromium automation reference server — simple, screenshot-driven browser control.
An MCP (Model Context Protocol) server that provides up-to-date CSS documentation from MDN and comprehensive CSS code analysis.
Keyless CHMI open data browser: warnings, forecasts, files.
Undetectable browser automation for AI agents via the Model Context Protocol.
FastAPI server implementing MCP protocol Browser automation via browser-use library.