# NezhaCyberMCP > Aggregate, store, and query security advisories from CIRCL, MyCERT, and GitHub Advisory Database — served directly to your AI assistant via MCP JSON-RPC 2.0. - **Type:** MCP server - **Install:** `agentstack add mcp-ctkqiang-nezhacybermcp` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [ctkqiang](https://agentstack.voostack.com/s/ctkqiang) - **Installs:** 0 - **Category:** [Databases](https://agentstack.voostack.com/c/databases) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [ctkqiang](https://github.com/ctkqiang) - **Source:** https://github.com/ctkqiang/NezhaCyberMCP - **Website:** https://www.nezhacyber.xin ## Install ```sh agentstack add mcp-ctkqiang-nezhacybermcp ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # NezhaCyberMCP **A production-grade Model Context Protocol (MCP) server for CVE vulnerability intelligence.** Aggregate, store, and query security advisories from CIRCL, MyCERT, and GitHub Advisory Database — served directly to your AI assistant via MCP JSON-RPC 2.0. [](https://go.dev) [](https://github.com/modelcontextprotocol/go-sdk) [](./LICENSE) [](https://aws.amazon.com/lambda/) [](https://gorm.io) [English](#) | [中文](./README_zh.md) --- ## Table of Contents - [Overview](#overview) - [System Architecture](#system-architecture) - [Data Sources](#data-sources) - [MCP Tools Reference](#mcp-tools-reference) - [Data Models](#data-models) - [Security Considerations](#security-considerations) - [Runtime Environments](#runtime-environments) - [Quick Start](#quick-start) - [Configuration Reference](#configuration-reference) - [Build & Deployment](#build--deployment) - [Database Support](#database-support) - [Rendered Diagrams](#rendered-diagrams) - [Project Structure](#project-structure) - [License](#license) --- ## Overview NezhaCyberMCP is a Go-based MCP server that bridges AI assistants (Claude, Cursor, VS Code Copilot) with a continuously updated CVE vulnerability database. It operates in three distinct runtime modes: | Mode | Trigger | Transport | Use Case | | --------------- | -------------------- | ---------------------- | --------------------------------- | | **Local** | `IS_LOCAL=true` | stdio (JSON-RPC 2.0) | Claude Desktop, local development | | **Lambda Sync** | EventBridge cron | — | Scheduled data ingestion only | | **Lambda MCP** | `MCP_HTTP_MODE=true` | SSE over HTTP (`/sse`) | Cloud-hosted MCP endpoint | The server exposes **18 registered MCP tools** covering CVE lookup, multi-dimensional search, CPE matching, severity filtering, trend analysis, and vendor/product statistics. --- ## System Architecture The system is organized into six distinct layers. Each layer has a single, well-defined responsibility and communicates only with adjacent layers. ``` +---------------------------+ | AI Client | Claude / Cursor / VS Code | (MCP JSON-RPC 2.0) | +---------------------------+ | v +---------------------------+ | Transport Layer | stdio (local) | SSE HTTP (Lambda) +---------------------------+ | v +---------------------------+ | MCP Protocol Layer | MCPServer + 18 Tools (mcp.go) | Actions Dispatcher | actions.go — query routing +---------------------------+ | v +---------------------------+ | Persistence Layer | GORM repositories (3 tables) | (Repository Pattern) | Upsert, batch write, query +---------------------------+ | v +---------------------------+ | Database | PostgreSQL / MySQL / SQLite | | Amazon Aurora DSQL (AWS) +---------------------------+ ^ | +---------------------------+ | Data Ingestion Layer | CirclService / GithubService | + Scheduling Layer | MycertService + cron/v3 +---------------------------+ ^ | +---------------------------+ | External Data Sources | CIRCL API / GitHub API | | MyCERT Portal (HTML scraping) +---------------------------+ ``` ### Architecture Diagram (PlantUML) > The full PlantUML source is available at [`docs/en/flow.puml`](./docs/en/flow.puml). > Render it with [PlantUML Online](https://www.plantuml.com/plantuml/uml/) or the VS Code PlantUML extension. ```plantuml @startuml ' See docs/en/flow.puml for the complete diagram source. ' Key component relationships: ' ' External Sources --> Services --> Repositories --> Database ' AdvisoryJob (cron) --> Services (trigger) ' MCPServer --> Actions --> Database (query) ' MCPServer --> Transport --> AI Client @enduml ``` ### Sequence Diagram (PlantUML) > The full request lifecycle and data sync sequence is at [`docs/en/sequence.puml`](./docs/en/sequence.puml). **Key design decision — non-blocking startup:** The `MCPServer` is constructed with a `nil` database connection and starts immediately. The MCP protocol handshake (`initialize` → `initialized`) completes before any database I/O begins. The database connection is established in a background goroutine and hot-injected via `SetDB()` once ready. This ensures the AI client never experiences a connection timeout during server startup. ``` main() | +-- NewMCPServer(nil) ` declaration at the top of each `.puml` source file: - `@startuml NezhaCyberMCP_Architecture` → `NezhaCyberMCP_Architecture.png` - `@startuml NezhaCyberMCP_Sequence` → `NezhaCyberMCP_Sequence.png` - `@startuml NezhaCyberMCP_架构图` → `NezhaCyberMCP_架构图.png` - `@startuml NezhaCyberMCP_时序图` → `NezhaCyberMCP_时序图.png` ### Regenerating the Diagrams To regenerate all PNG files from the `.puml` sources, run PlantUML against the `docs/` directory with the output path set to `out/docs/`: ```bash # Requires Java and PlantUML jar, or the plantuml CLI plantuml -tpng -o ../../out/docs/en/flow/ docs/en/flow.puml plantuml -tpng -o ../../out/docs/en/sequence/ docs/en/sequence.puml plantuml -tpng -o ../../out/docs/zh/flow/ docs/zh/flow.puml plantuml -tpng -o ../../out/docs/zh/sequence/ docs/zh/sequence.puml ``` Or use the VS Code PlantUML extension (`Alt+D` to preview, `Ctrl+Shift+P` → `PlantUML: Export Current File Diagrams`) and set the export directory to `out/`. > **Note:** The `out/` directory is intentionally committed to the repository so that rendered diagrams are immediately viewable on GitHub without requiring any local tooling. --- ## Project Structure ``` NezhaCyberMCP/ ├── main.go # Entry point, runtime mode selection ├── go.mod # Go module definition ├── Makefile # Build, test, lint, Lambda packaging ├── docs/ │ ├── en/ │ │ ├── flow.puml # System architecture diagram source (English) │ │ └── sequence.puml # Request/sync sequence diagram source (English) │ └── zh/ │ ├── flow.puml # System architecture diagram source (Chinese) │ └── sequence.puml # Request/sync sequence diagram source (Chinese) ├── out/ │ └── docs/ │ ├── en/ │ │ ├── flow/ │ │ │ └── NezhaCyberMCP_Architecture.png # Rendered architecture diagram (English) │ │ └── sequence/ │ │ └── NezhaCyberMCP_Sequence.png # Rendered sequence diagram (English) │ └── zh/ │ ├── flow/ │ │ └── NezhaCyberMCP_架构图.png # Rendered architecture diagram (Chinese) │ └── sequence/ │ └── NezhaCyberMCP_时序图.png # Rendered sequence diagram (Chinese) ├── internal/ │ ├── functions/ │ │ └── actions.go # MCP tool implementations & DB query logic │ ├── job/ │ │ └── advisory_job.go # cron scheduler, migration, sync orchestration │ ├── model/ │ │ ├── circl_cve.go # CirclCVE GORM model │ │ ├── github_advisory.go # GithubAdvisory GORM model │ │ └── mycert_advisory.go # MycertAdvisory GORM model │ ├── repository/ │ │ ├── circl_cve_repository.go │ │ ├── github_advisory_repository.go │ │ └── mycert_advisory_repository.go │ ├── services/ │ │ ├── circl.go # CIRCL API client & scraper │ │ ├── database.go # DB connection factory │ │ ├── github.go # GitHub Advisory API client │ │ ├── mcp.go # MCPServer: tool/resource/prompt registration │ │ └── mycert.go # MyCERT HTML scraper │ └── utilities/ │ ├── aws.go # AWS environment detection & credential validation │ └── logger.go # Structured logger (LogStart/Progress/Success/Error/Warn) ├── test/ │ ├── aws_test.go │ ├── circl_cve_test.go │ ├── database_dsql_test.go │ ├── db_environment_test.go │ ├── github_advisory_repository_test.go │ ├── mycert_repository_test.go │ └── mycert_scraper_test.go └── landing/ # Vue/Nuxt landing page (separate deployment) ``` --- ## License ``` MIT License Copyright (c) 2026 ctkqiang Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ``` --- ## Support / 支持 If you find this project helpful, feel free to buy me a coffee — your support keeps this project alive! 如果您觉得本项目对您有帮助，欢迎请我喝杯咖啡，您的支持是我持续维护和改进的动力！ WeChat Donation / 微信扫码捐赠 --- Built with Go · Powered by MCP · Secured by design · ctkqiang ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [ctkqiang](https://github.com/ctkqiang) - **Source:** [ctkqiang/NezhaCyberMCP](https://github.com/ctkqiang/NezhaCyberMCP) - **License:** MIT - **Homepage:** https://www.nezhacyber.xin Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** yes - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-ctkqiang-nezhacybermcp - Seller: https://agentstack.voostack.com/s/ctkqiang - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.