com.datakoot由 datakoot.com 发布官方发布者v2.1.0更新于 Oct 24, 2026
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
发布方自己的服务：Base Intel MCP
远程、免密钥的 MCP 服务器，让助手查询 CVE 详情、利用概率与已知在野利用情况，并审计软件包依赖的已知漏洞。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/com.datakoot%2Fcve-vulnerability-lookup/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"security-intel": {
"type": "http",
"url": "https://security.datakoot.com/mcp"
}
}
}Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.
No API keys required for any tool.
Or point any MCP client at https://security.datakoot.com/mcp.
Paste this into a terminal:
You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.
Or point any MCP client at the URL and just ask your agent, in plain language:
Vulnerability data comes from the National Vulnerability Database (NIST — US public domain), CISA's Known Exploited Vulnerabilities catalog (US public domain), FIRST EPSS and OSV.dev (CC-BY 4.0), the same open sources used by scanners like Trivy and Grype.
Part of Datakoot — keyless intelligence APIs for AI agents.
来源：README.md，提交 d23446d
CVE Lookup
Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.
cve_id必填Known Exploited
Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.
limitcve_idvendorransomware_onlyEPSS Score
Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.
cve_idcve_idsPackage Vulnerabilities
List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
name必填versionecosystem必填Audit Dependencies
Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
manifestecosystemdependencies已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
com.datakoot官方发布者
一个托管、只读的 MCP 服务器，让助手查询 Base 链上数据：地址余额、ERC-20 代币信息、Gas 价格和交易状态。
com.datakoot官方发布者
Koot by Datakoot 是一个远程 MCP 服务器，让助手一次调用即可获得依赖风险、美国上市公司、域名和美国地点的简报。
com.datakoot官方发布者
无需密钥的远程 MCP 服务器，让助手获取美国天气预报、实时天气、警报、地震、海拔和地址地理编码，数据来自政府公开数据源。
com.datakoot官方发布者
一个远程 MCP 服务器，让助手无需密钥即可访问 SEC EDGAR 数据：公司身份、申报文件、全文检索、XBRL 财务数据和内部人交易。
com.datakoot官方发布者
一个远程 MCP 服务器，为助手提供 npm、PyPI 和 crates.io 的包情报，便于在安装或推荐依赖前先做评估。
claude mcp add --transport http security-intel https://security.datakoot.com/mcpcurl -s https://security.datakoot.com/mcp \ -H 'content-type: application/json' \ -H 'accept: application/json, text/event-stream' \ -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'