Security Intel MCP

com.datakootPublished by datakoot.comOfficial publisherv2.1.0Updated Oct 24, 2026

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

The publisher's own server: Base Intel MCP

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote, keyless MCP server that lets an assistant look up CVE details, exploit likelihood and known exploitation, and audit package dependencies for…

What you can do
  • Look up a CVE and get description, CVSS score and severity, vector, CWE, publish date and references
  • Check whether a CVE is on the CISA Known Exploited list, or list recently added exploited vulnerabilities filtered by vendor, product or ransomware use
  • Get EPSS exploit-probability scores and percentiles for one or many CVEs
  • List known vulnerabilities for a package and optional version across npm, PyPI, Cargo, Go, Maven, RubyGems, NuGet, Composer, Pub and Hex
  • Audit a whole dependency manifest or dependency list in one call and get per-package findings plus a summary
When to use it
Useful when an assistant needs to judge how urgent a CVE is, check whether a vulnerability is actively exploited, prioritize patching, or screen a project's dependencies before a deploy.
Requirements
A remote MCP endpoint; no API keys, signup or environment variables are needed. The client connects over streamable HTTP to the provider's hosted URL, so network access to that host is required.
Before you install
Queries, including CVE IDs and dependency manifests or package lists, are sent to the provider's hosted service and on to public sources such as NVD, CISA KEV, FIRST EPSS and OSV.dev. Avoid pasting manifests that contain private package names or internal registry details. The tools are read-only lookups.

Installation

In SourceWeft

  1. Open Security Intel MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.datakoot%2Fcve-vulnerability-lookup/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "security-intel": {
      "type": "http",
      "url": "https://security.datakoot.com/mcp"
    }
  }
}

README

Security Intel MCP — by Datakoot

Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.

Tools

ToolWhat it doesSource
cve_lookupCVE summary: description, CVSS score & severity, CWE, references, plus whether it is actively exploited (CISA KEV) and its exploit probability (EPSS)NVD (NIST), CISA KEV, FIRST EPSS
known_exploitedIs a CVE on CISA's Known Exploited Vulnerabilities catalog? Or list the newest exploited CVEs (filter by vendor, product or ransomware use)CISA KEV
epss_scoreExploit probability (0–1) and percentile for one or many CVEs: the chance each is exploited in the next 30 daysFIRST EPSS
package_vulnerabilitiesKnown vulnerabilities for a package/versionOSV.dev
audit_dependenciesAudit a whole package.json (or dependency list) in one callOSV.dev

No API keys required for any tool.

Quick start

claude mcp add --transport http security-intel https://security.datakoot.com/mcp

Or point any MCP client at https://security.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

bash
curl -s https://security.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'

You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

  • "Is CVE-2021-44228 something I need to worry about?"
  • "Which of these CVEs is actually being exploited right now?"
  • "Audit my package.json for known vulnerabilities before I deploy."

Data & attribution

Vulnerability data comes from the National Vulnerability Database (NIST — US public domain), CISA's Known Exploited Vulnerabilities catalog (US public domain), FIRST EPSS and OSV.dev (CC-BY 4.0), the same open sources used by scanners like Trivy and Grype.

Part of Datakoot — keyless intelligence APIs for AI agents.

Source: README.md at commit d23446d

Tools

5

cve_lookup

CVE Lookup

Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.

Parameterscve_idrequired

known_exploited

Known Exploited

Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.

Parameterslimitcve_idvendorransomware_only

epss_score

EPSS Score

Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.

Parameterscve_idcve_ids

package_vulnerabilities

Package Vulnerabilities

List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.

Parametersnamerequiredversionecosystemrequired

audit_dependencies

Audit Dependencies

Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.

Parametersmanifestecosystemdependencies

Version history

1
  1. v2.1.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Datakoot integrations

Base Intel MCP

com.datakootOfficial publisher

A hosted, read-only MCP server that lets an assistant look up Base blockchain data: address balances, ERC-20 token details, gas price and transaction status.

Streamable HTTPWeb executable
Databases5 toolsOct 24, 2026

Koot by Datakoot

com.datakootOfficial publisher

Koot by Datakoot is a remote MCP server that gives an assistant one-call briefings on dependency risk, US public companies, domains and US places.

Streamable HTTPWeb executable
Web Search & Scraping8 toolsOct 25, 2026

Weather & Geo Intel MCP

com.datakootOfficial publisher

Keyless remote MCP server giving assistants US weather forecasts, current conditions, alerts, earthquakes, elevation and address geocoding from government…

Streamable HTTPWeb executable
Location & Lifestyle6 toolsOct 24, 2026

Filings Intel MCP

com.datakootOfficial publisher

A remote MCP server that gives an assistant keyless access to SEC EDGAR data: company identity, filings, full-text filing search, XBRL financials and insider-tx

Streamable HTTPWeb executable
Web Search & Scraping5 toolsOct 24, 2026

Package Intel MCP

com.datakootOfficial publisher

A remote MCP server that gives an assistant package intelligence for npm, PyPI and crates.io, so it can vet a dependency before installing or recommending it.

Streamable HTTPWeb executable
Developer Tools6 toolsOct 24, 2026