Cisa-cybersecurity-mcp-server MCP Server

Cisa-cybersecurity-mcp-server is an MCP integration. CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Hosted connection

The registry lists a streamable-http connection at https://cisa-cybersecurity.caseyjhand.com/mcp.

Packages and local setup

The published npm package is @cyanheads/cisa-cybersecurity-mcp-server, version 0.3.0. Its declared MCP transport is stdio.

The package declares MCP_LOG_LEVEL: Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').; CISA_KEV_REFRESH_CRON: Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.; CISA_CSAF_MIRROR_PATH: Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.; CISA_CSAF_MIRROR_AUTO_INIT: Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.; CISA_CSAF_REFRESH_CRON: Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.; CISA_VULNRICHMENT_CACHE_TTL_SECONDS: Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.; CISA_FEED_CACHE_TTL_SECONDS: Seconds a parsed RSS feed window stays cached.; CISA_HTTP_TIMEOUT_MS: Per-request timeout in milliseconds for every upstream fetch..

This package has launch arguments in its registry record. Use the maintainer’s configuration for those arguments rather than launching it with only the package name.

The published npm package is @cyanheads/cisa-cybersecurity-mcp-server, version 0.3.0. Its declared MCP transport is streamable-http.

The package declares MCP_HTTP_HOST: The hostname for the HTTP server.; MCP_HTTP_PORT: The port to run the HTTP server on.; MCP_HTTP_ENDPOINT_PATH: The endpoint path for the MCP server.; MCP_AUTH_MODE: Authentication mode to use: 'none', 'jwt', or 'oauth'.; MCP_LOG_LEVEL: Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').; CISA_KEV_REFRESH_CRON: Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.; CISA_CSAF_MIRROR_PATH: Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.; CISA_CSAF_MIRROR_AUTO_INIT: Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.; CISA_CSAF_REFRESH_CRON: Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.; CISA_VULNRICHMENT_CACHE_TTL_SECONDS: Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.; CISA_FEED_CACHE_TTL_SECONDS: Seconds a parsed RSS feed window stays cached.; CISA_HTTP_TIMEOUT_MS: Per-request timeout in milliseconds for every upstream fetch..

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry · Project repository. This profile uses version 0.3.0 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related developer tools MCP servers for tools that cover the same kind of work.