Mcp Cve Intelligence Server Lite

MCP CVE Intelligence Server Lite

A streamlined Model Context Protocol (MCP) Server for cybersecurity intelligence, providing unified access to vulnerability data from multiple authoritative sources including NVD, MITRE, and GitHub Security Advisories. This Lite version focuses on core CVE intelligence capabilities with essential features for security professionals.

[](LICENSE) [](https://nodejs.org/) [](https://www.typescriptlang.org/) [](https://www.npmjs.com/package/@proug/mcp-cve-intelligence-server-lite) [](https://www.npmjs.com/package/@proug/mcp-cve-intelligence-server-lite) [](https://github.com/gnlds/mcp-cve-intelligence-server-lite/pkgs/container/mcp-cve-intelligence-server-lite) [](https://github.com/gnlds/mcp-cve-intelligence-server-lite/stargazers) [](https://github.com/gnlds/mcp-cve-intelligence-server-lite) [](https://github.com/gnlds/mcp-cve-intelligence-server-lite) [](https://eslint.org/) [](https://github.com/gnlds/mcp-cve-intelligence-server-lite/pulse)

🚀 Overview

The MCP CVE Intelligence Server Lite is a streamlined Model Context Protocol (MCP) Server designed for security professionals, penetration testers, and cybersecurity researchers who need essential vulnerability intelligence integrated into their AI workflows. This Lite edition focuses on core features, aggregating data from multiple authoritative sources and delivering actionable security insights through standardized protocols.

> Status: Lite edition with core CVE intelligence features and streamlined functionality.

Key Features (Lite Edition)

• 🔍 Multi-Source CVE Intelligence: Unified access to NVD, MITRE CVE Records, and GitHub Security Advisories
• 🎯 Essential Exploit Discovery: Pattern-based detection from Exploit-DB, GitHub PoCs, Metasploit, and PacketStorm
• 🧮 EPSS Risk Scoring: Environmental context-aware vulnerability prioritization with exploit prediction
• 📊 Complete CVSS Support: Full v4/v3/v2 metric analysis with intelligent severity assessment
• 🔧 CPE-Based Discovery: Product-specific vulnerability identification using standardized identifiers
• 📈 Trending Analysis: Real-time vulnerability trending based on severity, exploits, and activity
• 📋 Professional Reports: Generate security reports in multiple formats (Markdown, JSON, summary)
• ⚡ Performance Optimized: Intelligent caching, retry logic, and streamlined processing
• 🛡️ Security-First: Type-safe implementation with comprehensive input validation and sanitization
• 🚦 Rate Limiting: Intelligent request throttling with source-specific limits
• 📊 Health Monitoring: Real-time source availability and performance tracking

🛠️ Installation

Prerequisites

• Node.js: 20.0.0 or higher
• npm: Comes with Node.js

Quick Start

# Clone the repository
git clone https://github.com/gnlds/mcp-cve-intelligence-server-lite.git
cd mcp-cve-intelligence-server-lite

# Install dependencies
npm install

# Build the project
npm run build

# Start the server
npm start

Docker Deployment

Using Pre-built Image (Recommended)

# Pull and run the latest image from Docker Hub
docker run -d \
  --name mcp-cve-server \
  -p 13001:3001 \
  -e MCP_TRANSPORT_TYPE=http \
  -e MCP_HTTP_PORT=3001 \
  -e MCP_HTTP_HOST=0.0.0.0 \
  proug/mcp-cve-intelligence-server-lite:latest

# Server will be available at http://localhost:13001
# Health check: http://localhost:13001/health

Using Docker Compose

# Using the provided Docker setup
chmod +x docker-run.sh
./docker-run.sh up

# Server will be available at http://localhost:13001
# Health check: http://localhost:13001/health

Building from Source

# Build locally if you want to customize
docker build -t mcp-cve-intelligence-server-lite:local .
docker run -d -p 13001:3001 mcp-cve-intelligence-server-lite:local

> 📋 For advanced Docker configuration, customization, and deployment options, see [docs/DOCKER.md](docs/DOCKER.md)

MCP Client Setup

To use this server with MCP-compatible clients, install via NPM and configure:

# Quick install from NPM
npx @proug/mcp-cve-intelligence-server-lite@latest --help

VS Code Configuration:

{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "npx", 
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"]
    }
  }
}

> 📋 For complete MCP client configuration (VS Code, Claude Desktop, etc.), see the [Configuration](#configuration) section below.

📖 Usage

MCP Tools Available (Lite Edition)

The server provides 7 essential tools for comprehensive CVE intelligence and security analysis:

1. searchCves - Advanced CVE Search & Discovery

Search for vulnerabilities using flexible criteria with intelligent filtering:

{
  "keyword": "apache log4j",
  "severity": "CRITICAL", 
  "hasExploit": true,
  "dateStart": "2021-01-01",
  "dateEnd": "2024-12-31",
  "limit": 50,
  "source": "nvd"
}

Advanced Examples:

// Search for recent RCE vulnerabilities
{
  "keyword": "remote code execution",
  "severity": "HIGH,CRITICAL",
  "dateStart": "2024-01-01",
  "hasExploit": true,
  "limit": 100
}

// Find Windows privilege escalation issues
{
  "keyword": "windows privilege escalation",
  "severity": "MEDIUM,HIGH,CRITICAL",
  "limit": 25
}

2. getCveDetails - Comprehensive CVE Intelligence

Retrieve detailed vulnerability information with exploit analysis:

{
  "cveId": "CVE-2021-44228",
  "includeExploits": true,
  "includeReferences": true
}

Response includes:

• Complete CVSS v4/v3/v2 metrics and scoring
• CWE classifications and weakness analysis
• Affected products with CPE identifiers
• Known exploits from multiple sources
• EPSS risk scores and probability
• Vendor advisories and patches

3. getTrendingCves - Real-Time Vulnerability Intelligence

Discover currently trending vulnerabilities based on activity and severity:

{
  "limit": 25,
  "timeframe": "7d",
  "minSeverity": "MEDIUM"
}

Trending Analysis:

• Recently disclosed high-impact vulnerabilities
• CVEs with increasing exploit activity
• Vulnerabilities gaining security community attention
• Active discussions and proof-of-concepts

4. calculateEpssScores - Environmental Risk Assessment

Calculate context-aware EPSS scores for vulnerability prioritization:

{
  "cveIds": ["CVE-2021-44228", "CVE-2022-22965", "CVE-2023-23397"],
  "environmentContext": {
    "networkExposure": "internet-facing",
    "assetCriticality": "critical",
    "securityControls": ["waf", "ids", "edr"],
    "patchingCapability": "rapid"
  }
}

Environment Contexts:

• networkExposure: "internal", "dmz", "internet-facing"
• assetCriticality: "low", "medium", "high", "critical"
• securityControls: Array of deployed security measures
• patchingCapability: "limited", "standard", "rapid"

5. generateCveReport - Professional Security Reports

Generate comprehensive vulnerability reports in multiple formats:

{
  "cveIds": ["CVE-2021-44228", "CVE-2022-22965"],
  "format": "markdown",
  "includeExploits": true,
  "includeMetrics": true,
  "includeMitigation": true
}

Report Formats:

• markdown: Professional markdown reports
• json: Structured data for automation
• summary: Executive summary format

Report Sections:

• Executive summary with risk assessment
• Detailed vulnerability analysis
• Exploit availability and complexity
• Recommended mitigation strategies
• CVSS metrics and environmental scoring

6. searchByCpe - Product-Specific Vulnerability Discovery

Find vulnerabilities affecting specific products using CPE identifiers:

{
  "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
  "severity": "HIGH,CRITICAL",
  "hasExploit": true,
  "limit": 50
}

CPE Examples:

// Search for all Apache products
{
  "cpe": "cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*",
  "severity": "CRITICAL"
}

// Windows Server vulnerabilities
{
  "cpe": "cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*",
  "hasExploit": true
}

// Specific version targeting
{
  "cpe": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
  "includeExploits": true
}

7. getSourceHealth - Data Source Monitoring

Monitor the health and availability of CVE data sources:

{
  "includeMetrics": true,
  "includeLastUpdated": true
}

Health Metrics:

• Source availability status
• Response times and performance
• Last successful data update
• API rate limit status
• Error rates and reliability

Command Line Interface

The server includes a comprehensive CLI for production deployment and testing:

Quick Start Commands

# Quick start with HTTP transport
npm start -- quick-start --port 3001

# Start with stdio transport (default MCP)
npm start -- --transport stdio

# Start with custom configuration
npm start -- --transport http --port 3001 --log-level debug

Configuration Management

# Show current configuration and environment
npm start -- config

Health Monitoring & Testing

# Basic health check via HTTP endpoint
curl http://localhost:3001/health

# Test via MCP tools
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getSourceHealth", "arguments": {}}}'

Docker Integration

# Generate Docker commands and deployment info
npm start -- docker --port 3001

Advanced Options

# Custom transport and networking
npm start -- --transport http --port 3001 --host 0.0.0.0

# Set log level for debugging
npm start -- --transport http --log-level debug

# Help and available commands
npm start -- --help

Practical Usage Examples

Scenario 1: Security Assessment Workflow

# 1. Start the server for assessment
npm start -- quick-start --port 3001

# 2. Check source health
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getSourceHealth", "arguments": {}}}'

# 3. Search for critical vulnerabilities in your stack
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchByCpe", "arguments": {"cpe": "cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*", "severity": "CRITICAL"}}}'

# 4. Generate assessment report
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "generateCveReport", "arguments": {"cveIds": ["CVE-2021-44228"], "format": "markdown", "includeExploits": true}}}'

Scenario 2: Threat Intelligence Research

# 1. Find trending vulnerabilities
npm start -- --transport http --port 3001

# 2. Research specific CVE with exploits
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getCveDetails", "arguments": {"cveId": "CVE-2024-12345", "includeExploits": true}}}'

# 3. Calculate environmental risk
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "calculateEpssScores", "arguments": {"cveIds": ["CVE-2024-12345"], "environmentContext": {"networkExposure": "internet-facing", "assetCriticality": "critical"}}}}'

Scenario 3: Penetration Testing Preparation

# Search for exploitable vulnerabilities in target technology
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchCves", "arguments": {"keyword": "windows server 2019", "hasExploit": true, "severity": "HIGH,CRITICAL", "limit": 50}}}'

# Find recent RCE vulnerabilities
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchCves", "arguments": {"keyword": "remote code execution", "dateStart": "2024-01-01", "hasExploit": true}}}'

Configuration

Configure the server using environment variables or .env file:

MCP Client Configuration

To use this server with MCP-compatible clients (VS Code, Claude Desktop, etc.), you need to configure the client to connect to this server.

For VS Code:

Create a .vscode/mcp.json file in your workspace:

{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"]
    }
  }
}

Or for global configuration, run MCP: Open User Configuration in VS Code and add:

{
  "servers": {
    "cve-intelligence": {
      "type": "stdio", 
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"],
      "env": {
        "NVD_API_KEY": "${input:nvd-api-key}",
        "GITHUB_TOKEN": "${input:github-token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "nvd-api-key",
      "description": "NVD API Key (optional)",
      "password": true
    },
    {
      "type": "promptString", 
      "id": "github-token",
      "description": "GitHub Personal Access Token (optional)",
      "password": true
    }
  ]
}

For Claude Desktop:

Add to your Claude Desktop configuration file (~/Library/Application Support/Claude/config.json on macOS):

{
  "mcpServers": {
    "cve-intelligence": {
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"],
      "env": {
        "NVD_API_KEY": "your-optional-nvd-api-key",
        "GITHUB_TOKEN": "your-optional-github-token"
      }
    }
  }
}

For Docker Containers:

You can run the MCP server in a Docker container for enhanced security and isolation:

VS Code Configuration (STDIO Transport):

{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ]
    }
  }
}

VS Code Configuration (HTTP Transport):

{
  "servers": {
    "cve-intelligence": {
      "url": "http://localhost:3001/mcp"
    }
  }
}

Claude Desktop Configuration (STDIO Transport):

{
  "mcpServers": {
    "cve-intelligence": {
      "command": "docker",
      "args": [
        "run",
        "-i", 
        "--rm",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ],
      "env": {
        "NVD_API_KEY": "your-optional-nvd-api-key",
        "GITHUB_TOKEN": "your-optional-github-token"
      }
    }
  }
}

Claude Desktop Configuration (HTTP Transport):

{
  "mcpServers": {
    "cve-intelligence": {
      "command": "docker",
      "args": [
        "run",
        "-d",
        "--rm", 
        "-p", "3001:3001",
        "-e", "MCP_TRANSPORT_TYPE=http",
        "-e", "MCP_HTTP_PORT=3001",
        "-e", "MCP_HTTP_HOST=0.0.0.0",
        "-e", "NVD_API_KEY=your-optional-nvd-api-key",
        "-e", "GITHUB_TOKEN=your-optional-github-token",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ]
    }
  }
}

Docker Compose (Production Ready):

Use the provided docker-compose.yml for production deployments:

# Start with HTTP transport on port 13001
./docker-run.sh up

# Server available at: http://localhost:13001
# Health check: http://localhost:13001/health/live

> Note: When using Docker, the MCP server runs in an isolated container. The Docker image is available from Docker Hub: > > ``bash > # Pull the latest image > docker pull proug/mcp-cve-intelligence-server-lite:latest > > # Or build locally from source: > docker build -t mcp-cve-intelligence-server-lite:local . > ``

For Custom Implementations:

Start the server in stdio mode and connect via standard input/output:

# Start serv

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [gnlds](https://github.com/gnlds)
- **Source:** [gnlds/mcp-cve-intelligence-server-lite](https://github.com/gnlds/mcp-cve-intelligence-server-lite)
- **License:** MIT

Install and usage instructions live in the source repository linked above.