# Mcp Cve Intelligence Server Lite

> MCP server from gnlds/mcp-cve-intelligence-server-lite.

- **Type:** MCP server
- **Install:** `agentstack add mcp-gnlds-mcp-cve-intelligence-server-lite`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [gnlds](https://agentstack.voostack.com/s/gnlds)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [gnlds](https://github.com/gnlds)
- **Source:** https://github.com/gnlds/mcp-cve-intelligence-server-lite

## Install

```sh
agentstack add mcp-gnlds-mcp-cve-intelligence-server-lite
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP CVE Intelligence Server Lite

A streamlined **Model Context Protocol (MCP) Server** for cybersecurity intelligence, providing unified access to vulnerability data from multiple authoritative sources including NVD, MITRE, and GitHub Security Advisories. This **Lite version** focuses on core CVE intelligence capabilities with essential features for security professionals.

[](LICENSE)
[](https://nodejs.org/)
[](https://www.typescriptlang.org/)
[](https://www.npmjs.com/package/@proug/mcp-cve-intelligence-server-lite)
[](https://www.npmjs.com/package/@proug/mcp-cve-intelligence-server-lite)
[](https://github.com/gnlds/mcp-cve-intelligence-server-lite/pkgs/container/mcp-cve-intelligence-server-lite)
[](https://github.com/gnlds/mcp-cve-intelligence-server-lite/stargazers)
[](https://github.com/gnlds/mcp-cve-intelligence-server-lite)
[](https://github.com/gnlds/mcp-cve-intelligence-server-lite)
[](https://eslint.org/)
[](https://github.com/gnlds/mcp-cve-intelligence-server-lite/pulse)

## 🚀 Overview

The MCP CVE Intelligence Server Lite is a streamlined **Model Context Protocol (MCP) Server** designed for security professionals, penetration testers, and cybersecurity researchers who need essential vulnerability intelligence integrated into their AI workflows. This **Lite edition** focuses on core features, aggregating data from multiple authoritative sources and delivering actionable security insights through standardized protocols.

> **Status**: Lite edition with core CVE intelligence features and streamlined functionality.

### Key Features (Lite Edition)

- **🔍 Multi-Source CVE Intelligence**: Unified access to NVD, MITRE CVE Records, and GitHub Security Advisories
- **🎯 Essential Exploit Discovery**: Pattern-based detection from Exploit-DB, GitHub PoCs, Metasploit, and PacketStorm
- **🧮 EPSS Risk Scoring**: Environmental context-aware vulnerability prioritization with exploit prediction
- **📊 Complete CVSS Support**: Full v4/v3/v2 metric analysis with intelligent severity assessment
- **🔧 CPE-Based Discovery**: Product-specific vulnerability identification using standardized identifiers
- **📈 Trending Analysis**: Real-time vulnerability trending based on severity, exploits, and activity
- **📋 Professional Reports**: Generate security reports in multiple formats (Markdown, JSON, summary)
- **⚡ Performance Optimized**: Intelligent caching, retry logic, and streamlined processing
- **🛡️ Security-First**: Type-safe implementation with comprehensive input validation and sanitization
- **🚦 Rate Limiting**: Intelligent request throttling with source-specific limits
- **📊 Health Monitoring**: Real-time source availability and performance tracking

## 🛠️ Installation

### Prerequisites

- **Node.js**: 20.0.0 or higher
- **npm**: Comes with Node.js

### Quick Start

```bash
# Clone the repository
git clone https://github.com/gnlds/mcp-cve-intelligence-server-lite.git
cd mcp-cve-intelligence-server-lite

# Install dependencies
npm install

# Build the project
npm run build

# Start the server
npm start
```

### Docker Deployment

#### Using Pre-built Image (Recommended)

```bash
# Pull and run the latest image from Docker Hub
docker run -d \
  --name mcp-cve-server \
  -p 13001:3001 \
  -e MCP_TRANSPORT_TYPE=http \
  -e MCP_HTTP_PORT=3001 \
  -e MCP_HTTP_HOST=0.0.0.0 \
  proug/mcp-cve-intelligence-server-lite:latest

# Server will be available at http://localhost:13001
# Health check: http://localhost:13001/health
```

#### Using Docker Compose

```bash
# Using the provided Docker setup
chmod +x docker-run.sh
./docker-run.sh up

# Server will be available at http://localhost:13001
# Health check: http://localhost:13001/health
```

#### Building from Source

```bash
# Build locally if you want to customize
docker build -t mcp-cve-intelligence-server-lite:local .
docker run -d -p 13001:3001 mcp-cve-intelligence-server-lite:local
```

> 📋 **For advanced Docker configuration, customization, and deployment options, see [docs/DOCKER.md](docs/DOCKER.md)**

### MCP Client Setup

To use this server with MCP-compatible clients, install via NPM and configure:

```bash
# Quick install from NPM
npx @proug/mcp-cve-intelligence-server-lite@latest --help
```

**VS Code Configuration:**

```json
{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "npx", 
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"]
    }
  }
}
```

> 📋 **For complete MCP client configuration (VS Code, Claude Desktop, etc.), see the [Configuration](#configuration) section below.**

## 📖 Usage

### MCP Tools Available (Lite Edition)

The server provides **7 essential tools** for comprehensive CVE intelligence and security analysis:

#### 1. `searchCves` - Advanced CVE Search & Discovery

Search for vulnerabilities using flexible criteria with intelligent filtering:

```json
{
  "keyword": "apache log4j",
  "severity": "CRITICAL", 
  "hasExploit": true,
  "dateStart": "2021-01-01",
  "dateEnd": "2024-12-31",
  "limit": 50,
  "source": "nvd"
}
```

**Advanced Examples:**

```json
// Search for recent RCE vulnerabilities
{
  "keyword": "remote code execution",
  "severity": "HIGH,CRITICAL",
  "dateStart": "2024-01-01",
  "hasExploit": true,
  "limit": 100
}

// Find Windows privilege escalation issues
{
  "keyword": "windows privilege escalation",
  "severity": "MEDIUM,HIGH,CRITICAL",
  "limit": 25
}
```

#### 2. `getCveDetails` - Comprehensive CVE Intelligence

Retrieve detailed vulnerability information with exploit analysis:

```json
{
  "cveId": "CVE-2021-44228",
  "includeExploits": true,
  "includeReferences": true
}
```

**Response includes:**

- Complete CVSS v4/v3/v2 metrics and scoring
- CWE classifications and weakness analysis
- Affected products with CPE identifiers
- Known exploits from multiple sources
- EPSS risk scores and probability
- Vendor advisories and patches

#### 3. `getTrendingCves` - Real-Time Vulnerability Intelligence

Discover currently trending vulnerabilities based on activity and severity:

```json
{
  "limit": 25,
  "timeframe": "7d",
  "minSeverity": "MEDIUM"
}
```

**Trending Analysis:**

- Recently disclosed high-impact vulnerabilities
- CVEs with increasing exploit activity
- Vulnerabilities gaining security community attention
- Active discussions and proof-of-concepts

#### 4. `calculateEpssScores` - Environmental Risk Assessment

Calculate context-aware EPSS scores for vulnerability prioritization:

```json
{
  "cveIds": ["CVE-2021-44228", "CVE-2022-22965", "CVE-2023-23397"],
  "environmentContext": {
    "networkExposure": "internet-facing",
    "assetCriticality": "critical",
    "securityControls": ["waf", "ids", "edr"],
    "patchingCapability": "rapid"
  }
}
```

**Environment Contexts:**

- `networkExposure`: "internal", "dmz", "internet-facing"
- `assetCriticality`: "low", "medium", "high", "critical"
- `securityControls`: Array of deployed security measures
- `patchingCapability`: "limited", "standard", "rapid"

#### 5. `generateCveReport` - Professional Security Reports

Generate comprehensive vulnerability reports in multiple formats:

```json
{
  "cveIds": ["CVE-2021-44228", "CVE-2022-22965"],
  "format": "markdown",
  "includeExploits": true,
  "includeMetrics": true,
  "includeMitigation": true
}
```

**Report Formats:**

- `markdown`: Professional markdown reports
- `json`: Structured data for automation
- `summary`: Executive summary format

**Report Sections:**

- Executive summary with risk assessment
- Detailed vulnerability analysis
- Exploit availability and complexity
- Recommended mitigation strategies
- CVSS metrics and environmental scoring

#### 6. `searchByCpe` - Product-Specific Vulnerability Discovery

Find vulnerabilities affecting specific products using CPE identifiers:

```json
{
  "cpe": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
  "severity": "HIGH,CRITICAL",
  "hasExploit": true,
  "limit": 50
}
```

**CPE Examples:**

```json
// Search for all Apache products
{
  "cpe": "cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*",
  "severity": "CRITICAL"
}

// Windows Server vulnerabilities
{
  "cpe": "cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*",
  "hasExploit": true
}

// Specific version targeting
{
  "cpe": "cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*",
  "includeExploits": true
}
```

#### 7. `getSourceHealth` - Data Source Monitoring

Monitor the health and availability of CVE data sources:

```json
{
  "includeMetrics": true,
  "includeLastUpdated": true
}
```

**Health Metrics:**

- Source availability status
- Response times and performance
- Last successful data update
- API rate limit status
- Error rates and reliability

### Command Line Interface

The server includes a comprehensive CLI for production deployment and testing:

#### Quick Start Commands

```bash
# Quick start with HTTP transport
npm start -- quick-start --port 3001

# Start with stdio transport (default MCP)
npm start -- --transport stdio

# Start with custom configuration
npm start -- --transport http --port 3001 --log-level debug
```

#### Configuration Management

```bash
# Show current configuration and environment
npm start -- config
```

#### Health Monitoring & Testing

```bash
# Basic health check via HTTP endpoint
curl http://localhost:3001/health

# Test via MCP tools
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getSourceHealth", "arguments": {}}}'
```

#### Docker Integration

```bash
# Generate Docker commands and deployment info
npm start -- docker --port 3001
```

#### Advanced Options

```bash
# Custom transport and networking
npm start -- --transport http --port 3001 --host 0.0.0.0

# Set log level for debugging
npm start -- --transport http --log-level debug

# Help and available commands
npm start -- --help
```

### Practical Usage Examples

#### Scenario 1: Security Assessment Workflow

```bash
# 1. Start the server for assessment
npm start -- quick-start --port 3001

# 2. Check source health
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getSourceHealth", "arguments": {}}}'

# 3. Search for critical vulnerabilities in your stack
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchByCpe", "arguments": {"cpe": "cpe:2.3:a:apache:*:*:*:*:*:*:*:*:*", "severity": "CRITICAL"}}}'

# 4. Generate assessment report
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "generateCveReport", "arguments": {"cveIds": ["CVE-2021-44228"], "format": "markdown", "includeExploits": true}}}'
```

#### Scenario 2: Threat Intelligence Research

```bash
# 1. Find trending vulnerabilities
npm start -- --transport http --port 3001

# 2. Research specific CVE with exploits
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "getCveDetails", "arguments": {"cveId": "CVE-2024-12345", "includeExploits": true}}}'

# 3. Calculate environmental risk
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "calculateEpssScores", "arguments": {"cveIds": ["CVE-2024-12345"], "environmentContext": {"networkExposure": "internet-facing", "assetCriticality": "critical"}}}}'
```

#### Scenario 3: Penetration Testing Preparation

```bash
# Search for exploitable vulnerabilities in target technology
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchCves", "arguments": {"keyword": "windows server 2019", "hasExploit": true, "severity": "HIGH,CRITICAL", "limit": 50}}}'

# Find recent RCE vulnerabilities
curl -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -d '{"method": "tools/call", "params": {"name": "searchCves", "arguments": {"keyword": "remote code execution", "dateStart": "2024-01-01", "hasExploit": true}}}'
```

### Configuration

Configure the server using environment variables or `.env` file:

#### MCP Client Configuration

To use this server with MCP-compatible clients (VS Code, Claude Desktop, etc.), you need to configure the client to connect to this server.

**For VS Code:**

Create a `.vscode/mcp.json` file in your workspace:

```json
{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"]
    }
  }
}
```

Or for global configuration, run `MCP: Open User Configuration` in VS Code and add:

```json
{
  "servers": {
    "cve-intelligence": {
      "type": "stdio", 
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"],
      "env": {
        "NVD_API_KEY": "${input:nvd-api-key}",
        "GITHUB_TOKEN": "${input:github-token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "nvd-api-key",
      "description": "NVD API Key (optional)",
      "password": true
    },
    {
      "type": "promptString", 
      "id": "github-token",
      "description": "GitHub Personal Access Token (optional)",
      "password": true
    }
  ]
}
```

**For Claude Desktop:**

Add to your Claude Desktop configuration file (`~/Library/Application Support/Claude/config.json` on macOS):

```json
{
  "mcpServers": {
    "cve-intelligence": {
      "command": "npx",
      "args": ["-y", "mcp-cve-intelligence-server-lite@latest"],
      "env": {
        "NVD_API_KEY": "your-optional-nvd-api-key",
        "GITHUB_TOKEN": "your-optional-github-token"
      }
    }
  }
}
```

**For Docker Containers:**

You can run the MCP server in a Docker container for enhanced security and isolation:

*VS Code Configuration (STDIO Transport):*

```json
{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ]
    }
  }
}
```

*VS Code Configuration (HTTP Transport):*

```json
{
  "servers": {
    "cve-intelligence": {
      "url": "http://localhost:3001/mcp"
    }
  }
}
```

*Claude Desktop Configuration (STDIO Transport):*

```json
{
  "mcpServers": {
    "cve-intelligence": {
      "command": "docker",
      "args": [
        "run",
        "-i", 
        "--rm",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ],
      "env": {
        "NVD_API_KEY": "your-optional-nvd-api-key",
        "GITHUB_TOKEN": "your-optional-github-token"
      }
    }
  }
}
```

*Claude Desktop Configuration (HTTP Transport):*

```json
{
  "mcpServers": {
    "cve-intelligence": {
      "command": "docker",
      "args": [
        "run",
        "-d",
        "--rm", 
        "-p", "3001:3001",
        "-e", "MCP_TRANSPORT_TYPE=http",
        "-e", "MCP_HTTP_PORT=3001",
        "-e", "MCP_HTTP_HOST=0.0.0.0",
        "-e", "NVD_API_KEY=your-optional-nvd-api-key",
        "-e", "GITHUB_TOKEN=your-optional-github-token",
        "proug/mcp-cve-intelligence-server-lite:latest"
      ]
    }
  }
}
```

*Docker Compose (Production Ready):*

Use the provided docker-compose.yml for production deployments:

```bash
# Start with HTTP transport on port 13001
./docker-run.sh up

# Server available at: http://localhost:13001
# Health check: http://localhost:13001/health/live
```

> **Note**: When using Docker, the MCP server runs in an isolated container. The Docker image is available from Docker Hub:
>
> ```bash
> # Pull the latest image
> docker pull proug/mcp-cve-intelligence-server-lite:latest
> 
> # Or build locally from source:
> docker build -t mcp-cve-intelligence-server-lite:local .
> ```

**For Custom Implementations:**

Start the server in stdio mode and connect via standard input/output:

```bash
# Start serv

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [gnlds](https://github.com/gnlds)
- **Source:** [gnlds/mcp-cve-intelligence-server-lite](https://github.com/gnlds/mcp-cve-intelligence-server-lite)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-gnlds-mcp-cve-intelligence-server-lite
- Seller: https://agentstack.voostack.com/s/gnlds
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.