Vuln Triage Mcp

io.github.kimmawlaPublished by GitHub account kimmawlav0.1.0Updated Nov 5, 2026

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.kimmawla/vuln-triage-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 21, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account kimmawla for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.kimmawla%2Fvuln-triage-mcp.svg)](https://sourceweft.com/mcp/io.github.kimmawla%2Fvuln-triage-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server that ranks vulnerabilities by urgency using OSV.dev advisories, FIRST EPSS exploit probability and CISA KEV known exploitation.

What you can do: Look up raw advisory details for a single CVE or GHSA ID
Find advisories affecting a named package and version in a given ecosystem
Retrieve EPSS exploit-probability scores and check CISA KEV known-exploited status
Triage a vulnerability into a critical, high, medium, low or unknown bucket with a score and stated reasoning
Report partial results, truncation, stale KEV cache and missing data sources
When to use it: Useful when an assistant has to answer "which vulnerability should I fix first" or "is this CVE exploited in the wild", and when severity alone is not enough because exploit likelihood matters. Also handy for checking whether a specific package version has known advisories.
Requirements: Runs locally over stdio, typically launched with uvx from the PyPI package vuln-triage-mcp. Needs Python 3.12+ and network access to the OSV.dev, FIRST EPSS and CISA KEV public APIs. No API keys or credentials.

Before you install

Advisory text comes from third parties and is treated as a prompt-injection vector; it is sanitized, length-capped and returned as untrusted text. Results are read-only lookups, but EPSS scores drift daily and the KEV cache can be stale, so rankings may change over time. An unknown bucket means too little data, not low risk.

Installation

In SourceWeft

Open Vuln Triage Mcp in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

vuln-triage-mcp

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

[PyPI version] [Python 3.12+] [License: MIT] [Tests]

Why this exists

Two or three sentences. CVSS alone ranks by severity, not by likelihood of exploitation. This server adds exploit probability (EPSS) and known exploitation (KEV), and shows its reasoning. Example: a CVSS 9.8 nobody exploits ranks below a CVSS 8.8 that is being exploited in the wild.

Quick start

Claude Code

claude mcp add vuln-triage -- uvx vuln-triage-mcp

Claude Desktop / other clients

JSON config snippet using uvx. Requires: Python 3.12+, no API keys.

Try it

Three example prompts and what to expect:

"Which is most urgent: CVE-2021-44228, CVE-2023-4863, CVE-2019-10744?"
"Is lodash 4.17.15 vulnerable? What should I upgrade to?"
"Is CVE-XXXX actively exploited?"

Tools

Tool	Args	Use it when	Prefer another when
lookup_vulnerability	vuln_id	raw advisory details for one CVE/GHSA	user wants prioritization -> triage_vulnerability
find_vulns_for_package	name, ecosystem, version=""	"what vulns affect package X (version Y)"	user already has an ID
get_epss_score	cve_id	exploit-probability only	user wants overall priority -> triage_vulnerability
check_known_exploited	cve_id	"is this exploited in the wild" (CISA KEV)	same
triage_vulnerability	vuln_id	any "how urgent / what should I fix first" question	raw details only -> lookup_vulnerability

How scoring works

Formula: CVSS (base) x 40 + EPSS x 35 + KEV +25; KEV-listed floors at 80
Buckets: see the table below
Missing data: component omitted, named in reasoning, lowers confidence
Link to docs/scoring-spec.md

Bucket	When
critical	score >= 80, or listed in CISA KEV (always floored to 80, whatever the confidence)
high	score 60-79
medium	score 40-59
low	score < 40
unknown	not KEV-listed, and either no CVSS severity or low confidence (0-1 of 3 signals). Too little data to classify; the score is still returned, and `reasoning` names what is missing. Not a low-risk verdict.

unknown takes precedence over high, medium, and low; it never applies to a KEV-listed vulnerability.

Reliability and limits

Partial results: if EPSS or KEV fails, the result names the missing source
Truncation: truncated, found_count vs returned_count, ranking_note
Stale KEV cache: stale and catalog_fetched_at
Timeouts and retry policy (one line)
Package queries return at most 50 advisories, sorted by severity

Security

Advisory text is untrusted third-party content (prompt injection vector): sanitized, length-capped, returned under untrusted_text, and flagged to the model in the server instructions
Input validation on all IDs and ecosystems
No credentials required or stored; read-only calls to three public APIs
Reporting vulnerabilities in this project: SECURITY.md or email

Evaluation

Golden set: 17 entries (16 CVEs, 1 GHSA) with expected buckets, confidence, and ordering, recorded 10/21/2026. Result: 17/17 match on the recorded fixtures (uv run pytest tests/test_golden.py), and 17/17 against the live APIs on 10/21/2026 (uv run pytest -m live tests/test_golden.py). EPSS drifts daily, so the live run can diverge over time; re-record the fixtures with uv run python scripts/record_golden_fixtures.py when the golden set or scoring spec changes.

Data sources and attribution

OSV.dev, FIRST EPSS (cite per their usage terms), CISA KEV. Not affiliated with any of them.

Development

uv sync, uv run pytest, running the Inspector, live-test marker.

License

MIT

Source: README.md at commit 9545145

Tools

SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package did not install.

Version history

v0.1.0LatestOct 21, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts