Purify Security Feeds

io.github.eason4kim-rocketPublished by GitHub account eason4kim-rocketv1.0.1Updated Oct 24, 2026

Query CISA KEV / EPSS vulnerability feeds with full per-record provenance and auditable versions

VerifiedSTDIODesktop onlySecurity & Monitoring Data & Analytics

Server details

Identifier: io.github.eason4kim-rocket/purify-feeds-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account eason4kim-rocket for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.eason4kim-rocket%2Fpurify-feeds-mcp.svg)](https://sourceweft.com/mcp/io.github.eason4kim-rocket%2Fpurify-feeds-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Lets an assistant query CISA KEV, EPSS and enriched vulnerability feeds with per-record provenance and auditable feed versions.

What you can do: Exposes four tools over Purify's security-intelligence feeds: list_feeds shows feeds with record counts and current version, search_feed applies AND filters, sorting and returns up to 50 rows with an exact total_matched count, get_provenance returns a record's _purify data passport and the feed's run chain by CVE id, and check_feed_changed compares a known hash to detect new feed versions. Feeds cover the CISA Known Exploited Vulnerabilities catalog, an EPSS high-risk slice, and an EPSS plus KEV joined view with risk bands. Each record carries provenance such as source, fetch time, extractor and raw artifact hash.
When to use it: Useful when an assistant needs to answer questions about known exploited vulnerabilities or exploit prediction scores, for example which CVEs entered CISA KEV recently, how many high-EPSS CVEs are also in KEV, or where a specific CVE's data came from. Also suited to agent loops that track an artifact hash and only re-triage when a feed version actually changes.
Requirements: Runs as a local process over stdio, desktop only. Install via Go, the published container image, or a source build. Requires the PURIFY_API_KEY secret, sent as a bearer token and issued manually during the pilot by opening a GitHub issue. PURIFY_API_URL sets the feeds API base URL and defaults to the public gateway; PURIFY_FEEDS can override the built-in feed table. Network access to the feeds gateway is needed.

Before you install

PURIFY_API_KEY is a required secret sent as a bearer token to the feeds gateway; keep it out of shared configuration. The public gateway is described as read-only with GET only, a feed whitelist and per-key rate limits, so queries go to a third-party service. The tools read feed data; no write, send or delete actions are described.

Installation

In SourceWeft

Open Purify Security Feeds in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

purify-feeds-mcp

MCP server for Purify's production security-intelligence feeds. Lets Claude Desktop, Cursor and other MCP clients query live CISA KEV / EPSS / enriched vulnerability feeds — every answer carries an auditable feed version and full per-record provenance.

The feeds behind this server are continuously scheduled, quality-gated and self-healing. Each record ships with a _purify data passport: where it was fetched from, when, with which extractor, and the hash of the raw artifact it came from.

Tools

Tool	Purpose
`list_feeds`	List feeds with record counts and current version (dataset artifact hash)
`search_feed`	AND filters / sort / up to 50 rows, plus an exact `total_matched` count
`get_provenance`	Return a record's `_purify` passport and the feed's run chain, by CVE id
`check_feed_changed`	Incremental primitive: compare a known hash to detect new feed versions

Feeds

Install

Or use the Docker image (no Go toolchain needed):

Or build from source:

Configure (Claude Desktop)

~/Library/Application Support/Claude/claude_desktop_config.json:

json

{  "mcpServers": {    "purify-feeds": {      "command": "/path/to/purify-feeds-mcp",      "env": {        "PURIFY_API_URL": "https://feeds.verifly.pro/feeds-api",        "PURIFY_API_KEY": "<your-api-key>"      }    }  }}

{  "mcpServers": {    "purify-feeds": {      "command": "/path/to/purify-feeds-mcp",      "env": {        "PURIFY_API_URL": "https://feeds.verifly.pro/feeds-api",        "PURIFY_API_KEY": "<your-api-key>"      }    }  }}

Or with Docker (the image defaults PURIFY_API_URL to the public gateway):

json

{  "mcpServers": {    "purify-feeds": {      "command": "docker",      "args": ["run", "-i", "--rm", "-e", "PURIFY_API_KEY",               "ghcr.io/eason4kim-rocket/purify-feeds-mcp:latest"],      "env": { "PURIFY_API_KEY": "<your-api-key>" }    }  }}

{  "mcpServers": {    "purify-feeds": {      "command": "docker",      "args": ["run", "-i", "--rm", "-e", "PURIFY_API_KEY",               "ghcr.io/eason4kim-rocket/purify-feeds-mcp:latest"],      "env": { "PURIFY_API_KEY": "<your-api-key>" }    }  }}

The public gateway is read-only (GET only, feed whitelist, per-key rate limits). Health check: https://feeds.verifly.pro/healthz — no key needed. API keys are issued manually during the pilot — open an issue or contact the maintainer to get one.

Environment variables

PURIFY_API_URL — feeds API base URL (default http://127.0.0.1:8091 for local/dev use)
PURIFY_API_KEY — API key, sent as a bearer token (required for the public gateway)
PURIFY_FEEDS — override the built-in feed table: name=spec_id,...

Example prompts

"Which CVEs entered CISA KEV in the last 7 days? Give vendors and remediation due dates."
"How many CVEs have EPSS > 0.99 and are in KEV? Top 5?"
"Where does the data for CVE-2026-45659 come from?" (get_provenance returns the full passport)
Agent loops: remember artifact_hash, call check_feed_changed first on the next run, and only re-triage when the feed actually changed.

License

MIT

Source: README.md at commit de53baa

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Name	Contents
`kev`	CISA Known Exploited Vulnerabilities catalog
`epss`	EPSS high-risk slice (exploit prediction scores)
`enriched`	EPSS + KEV joined view with risk bands