Cisa Kev Mcp

io.github.mrfentmenPublished by GitHub account mrfentmenv1.0.1Updated Nov 5, 2026

Use this MCP server to CISA Known Exploited Vulnerabilities catalog search. Tools include search...

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Searches CISA's Known Exploited Vulnerabilities catalog so an assistant can look up CVEs, vendors and recently added exploited flaws.

What you can do
  • Search the CISA KEV catalog by CVE, vendor, product, vulnerability name or description
  • List recently added catalog entries
  • Inspect catalog metadata such as version, release date and entry count
When to use it
Useful when triaging vulnerabilities or reviewing scanner findings and you want to know whether a CVE is listed by CISA as exploited in the wild. It is a prioritization aid, not a full risk assessment.
Requirements
Runs as a local process via the npm package cisa-kev-mcp (Node.js, built and started with node). The CISA feed is public and keyless, so no account, API key or environment variables are declared; network access is needed to reach the feed.
Before you install
Read-only lookups against a public feed; no credentials or writes are involved. Catalog inclusion is only a prioritization signal and does not prove a system is vulnerable or replace a complete risk assessment.

Installation

In SourceWeft

  1. Open Cisa Kev Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

cisa-kev-mcp

Search CISA's Known Exploited Vulnerabilities catalog. This is a focused companion to vulnerability scanners: it helps an agent identify vulnerabilities that CISA has marked as exploited in the wild.

Tools

  • search_known_exploited: search CVE, vendor, product, vulnerability name, and description fields.
  • recent_known_exploited: list recently added catalog entries.
  • catalog_info: inspect catalog version, release date, and entry count.

The feed is public and keyless. Catalog inclusion is a prioritization signal, not a complete risk assessment or a guarantee that a system is vulnerable.

Run

bash
npm installnpm run buildnode dist/index.js

Source: README.md at commit 393e453

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 22, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.