Security Intel MCP

io.github.selflabbsPublished by GitHub account selflabbsv2.0.0Updated Oct 24, 2026

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that gives an assistant CVE lookups, exploit-probability scores and dependency audits from NVD, CISA KEV, EPSS and OSV.

What you can do
  • Look up a CVE's description, CVSS score and severity, CWE and references, with KEV and EPSS context
  • Check whether a CVE is in CISA's Known Exploited Vulnerabilities catalog, or list the newest exploited CVEs filtered by vendor, product or ransomware use
  • Get exploit probability and percentile for one or many CVEs
  • Find known vulnerabilities for a package and version
  • Audit a whole package.json or dependency list in one call
When to use it
Useful when an assistant needs to judge whether a CVE matters, triage a list of CVEs by real-world exploitation, or check dependencies for known vulnerabilities before a deploy.
Requirements
A remote streamable HTTP endpoint; no API keys, signup or environment variables are needed. Any MCP client that supports HTTP transport can connect.
Before you install
Queries, including CVE IDs and dependency manifests, are sent to a third-party service, which in turn queries NVD, CISA KEV, FIRST EPSS and OSV.dev. The README's endpoint URL differs from the one in the manifest, so confirm which URL to use. Results are advisory and should not replace a full scanner.

Installation

In SourceWeft

  1. Open Security Intel MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.selflabbs%2Fsecurity-intel-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "security-intel": {
      "type": "http",
      "url": "https://security.selflabbs.com/mcp"
    }
  }
}

README

Security Intel MCP — by Datakoot

Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.

Tools

ToolWhat it doesSource
cve_lookupCVE summary: description, CVSS score & severity, CWE, references, plus whether it is actively exploited (CISA KEV) and its exploit probability (EPSS)NVD (NIST), CISA KEV, FIRST EPSS
known_exploitedIs a CVE on CISA's Known Exploited Vulnerabilities catalog? Or list the newest exploited CVEs (filter by vendor, product or ransomware use)CISA KEV
epss_scoreExploit probability (0–1) and percentile for one or many CVEs: the chance each is exploited in the next 30 daysFIRST EPSS
package_vulnerabilitiesKnown vulnerabilities for a package/versionOSV.dev
audit_dependenciesAudit a whole package.json (or dependency list) in one callOSV.dev

No API keys required for any tool.

Quick start

claude mcp add --transport http security-intel https://security.datakoot.com/mcp

Or point any MCP client at https://security.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

bash
curl -s https://security.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'

You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

  • "Is CVE-2021-44228 something I need to worry about?"
  • "Which of these CVEs is actually being exploited right now?"
  • "Audit my package.json for known vulnerabilities before I deploy."

Data & attribution

Vulnerability data comes from the National Vulnerability Database (NIST — US public domain), CISA's Known Exploited Vulnerabilities catalog (US public domain), FIRST EPSS and OSV.dev (CC-BY 4.0), the same open sources used by scanners like Trivy and Grype.

Part of Datakoot — keyless intelligence APIs for AI agents.

Source: README.md at commit d23446d

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v2.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts