Competitive Intel

io.github.martc03Published by GitHub account martc03v1.0.0Updated Oct 24, 2026

SEC filings, patent data, and trade data. 4 competitive intel tools.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Remote MCP server that gives an assistant unified CVE vulnerability intelligence from NVD, CISA KEV, EPSS and MITRE ATT&CK in single lookups.

What you can do
  • Look up a single CVE and get NVD details, CVSS score, KEV exploitation status, EPSS probability and ATT&CK techniques together
  • Search CVEs by keyword, severity and date range, optionally limited to actively exploited ones
  • List recently added KEV entries and KEV entries with remediation deadlines approaching
  • Rank CVEs by EPSS exploitation probability and list newly published critical CVEs
  • Assess a vendor or product's CVEs with KEV cross-referencing
When to use it
Useful for vulnerability triage, patch prioritization, CISA KEV compliance tracking, threat intelligence on trending CVEs, and vendor risk assessment where answers need to combine several public vulnerability feeds.
Requirements
A remote Streamable HTTP endpoint; no local runtime or package needed for the hosted option. The README's local stdio option needs Node.js 18+ and a build step. An optional NVD_API_KEY raises NVD rate limits; the underlying government data sources are free.
Before you install
The registry description mentions SEC filings, patents and trade data, while the README describes a cybersecurity vulnerability server with different tools and a different hosted URL, so confirm which server you are actually connecting to. The optional NVD_API_KEY is a credential and should be supplied via environment variable, not shared. Results are read-only lookups from third-party public feeds and may lag their update cycles.

Installation

In SourceWeft

  1. Open Competitive Intel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.martc03%2Fcompetitive-intel/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "competitive-intel": {
      "type": "http",
      "url": "https://competitive-intel-mcp.apify.actor/mcp"
    }
  }
}

README

Cybersecurity Vulnerability Intelligence MCP Server

Unified vulnerability intelligence from 4 government data sources in a single MCP server. Get enriched CVE lookups with CVSS scores, active exploitation status, exploitation probability, and ATT&CK techniques in one call.

SourceWhat It ProvidesUpdate Frequency
NIST NVD 2.0CVE details, CVSS scores, descriptions, references, CWE classificationsContinuous
CISA KEVActively exploited vulnerabilities catalog, remediation deadlinesDaily
FIRST.org EPSSExploitation probability scores (0-1) predicting likelihood of exploitation in next 30 daysDaily
MITRE ATT&CKAdversary techniques mapped to CVEsQuarterly

Tools

vuln_lookup_cve — Enriched CVE Lookup

The killer feature. Look up any CVE and get intelligence from all 4 sources in a single call.

  • Input: { cveId: "CVE-2021-44228" }
  • Returns: NVD details + CVSS score + KEV exploitation status + EPSS probability + ATT&CK techniques

vuln_search — Search CVEs

Search the NVD by keyword, severity, and date range. Optionally filter to only actively exploited (KEV) vulnerabilities.

  • Input: { keyword: "apache log4j", severity: "CRITICAL", hasKev: true, limit: 20 }

vuln_kev_latest — Recently Exploited Vulnerabilities

Get vulnerabilities recently added to CISA's Known Exploited Vulnerabilities catalog.

  • Input: { days: 7, limit: 20 }

vuln_kev_due_soon — Upcoming Remediation Deadlines

Get KEV entries with remediation deadlines approaching. Critical for federal compliance.

  • Input: { days: 14, limit: 20 }

vuln_epss_top — Highest Exploitation Probability

Get CVEs most likely to be exploited in the next 30 days based on EPSS machine learning model.

  • Input: { threshold: 0.7, limit: 20 }

vuln_trending — Newly Published Critical CVEs

Get recently published high/critical severity CVEs from the NVD.

  • Input: { days: 3, severity: "CRITICAL", limit: 20 }

vuln_by_vendor — Vendor Vulnerability Assessment

Search CVEs for a specific vendor/product. Cross-references with CISA KEV to flag actively exploited issues.

  • Input: { vendor: "microsoft", product: "windows", limit: 20 }

Use Cases

  • Vulnerability triage: Look up a CVE and instantly know if it's actively exploited, its EPSS score, and what ATT&CK techniques apply
  • Patch prioritization: Combine KEV status + EPSS scores to prioritize remediation
  • Compliance tracking: Monitor upcoming CISA KEV remediation deadlines
  • Threat intelligence: Track trending CVEs and newly weaponized vulnerabilities
  • Vendor risk assessment: Assess a vendor's vulnerability exposure and active exploitation status

Quick Start

Glama (hosted)

Install from Glama.ai.

Apify (hosted)

json
{  "mcpServers": {    "cybersecurity": {      "url": "https://cybersecurity-vuln-mcp.apify.actor/mcp"    }  }}

Claude Desktop / Claude Code

json
{  "mcpServers": {    "cybersecurity": {      "command": "node",      "args": ["path/to/servers/cybersecurity-vuln-mcp/dist/stdio.js"],      "env": {        "NVD_API_KEY": "your-key-here"      }    }  }}

Local (stdio)

bash
git clone https://github.com/martc03/gov-mcp-servers.gitcd gov-mcp-servers/servers/cybersecurity-vuln-mcpnpm install && npm run buildnode dist/stdio.js

Environment Variables

VariableRequiredDescription
NVD_API_KEYNoNVD API key for higher rate limits (50 req/30s vs 5 req/30s). Register here.

Caching

Data SourceTTLNotes
NVD CVE lookups1 hourPer-CVE
CISA KEV catalog2 hoursFull catalog
EPSS scores24 hoursPer-CVE
ATT&CK mappingsStaticBundled with server

Architecture

  • Protocol: MCP over stdio (Glama/local) or Streamable HTTP (Apify)
  • Runtime: Node.js 18+, TypeScript
  • Data: Direct API calls to free government data sources, zero cost
  • Caching: In-memory with configurable TTLs

Other Servers in This Repo

This repository contains 13 MCP servers for US government data. See each server's README for details.

ServerToolsData Sources
us-safety-recalls-mcp4NHTSA recalls, FDA recalls
natural-disaster-intel-mcp4FEMA disasters, NOAA weather, USGS earthquakes
federal-financial-intel-mcp4SEC EDGAR, CFPB complaints, BLS employment
immigration-travel-mcp3Visa bulletins, border wait times
environmental-compliance-mcp3EPA air quality, HUD foreclosures
gov-contracts-mcp4SAM.gov contracts, USAspending
court-records-mcp4PACER, federal court records
public-health-mcp4NIH clinical trials, FDA adverse events
business-entity-mcp4SEC company search, SBA resources
regulatory-monitor-mcp4Federal Register, regulations.gov
grant-finder-mcp4Grants.gov, USAspending
competitive-intel-mcp4SEC filings, patent data, trade data

A REST API gateway with 45 endpoints is also available at govdata-api.netlify.app.

Attribution

  • NVD: This product uses data from the NVD API but is not endorsed or certified by the NVD.
  • EPSS: Data provided by FIRST.org (https://www.first.org/epss/).
  • ATT&CK: Registered trademark of The MITRE Corporation. Licensed under Apache 2.0.
  • KEV: CISA Known Exploited Vulnerabilities Catalog, US Government public domain.

Custom MCP Server Development

Need a custom MCP server for your business? Visit mcpdev.netlify.app or email [email protected].

License

MIT

Source: README.md at commit 26427e2

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts