com.datakoot由 datakoot.com 發布官方發布者v2.1.0更新於 Oct 24, 2026
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
發布方自己的服務：Base Intel MCP
遠端、免金鑰的 MCP 伺服器，讓助理查詢 CVE 詳情、利用機率與已知在野利用情況，並稽核套件相依性的已知漏洞。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/com.datakoot%2Fcve-vulnerability-lookup/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"security-intel": {
"type": "http",
"url": "https://security.datakoot.com/mcp"
}
}
}Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.
No API keys required for any tool.
Or point any MCP client at https://security.datakoot.com/mcp.
Paste this into a terminal:
You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.
Or point any MCP client at the URL and just ask your agent, in plain language:
Vulnerability data comes from the National Vulnerability Database (NIST — US public domain), CISA's Known Exploited Vulnerabilities catalog (US public domain), FIRST EPSS and OSV.dev (CC-BY 4.0), the same open sources used by scanners like Trivy and Grype.
Part of Datakoot — keyless intelligence APIs for AI agents.
來源：README.md，提交 d23446d
CVE Lookup
Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.
cve_id必填Known Exploited
Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.
limitcve_idvendorransomware_onlyEPSS Score
Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.
cve_idcve_idsPackage Vulnerabilities
List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
name必填versionecosystem必填Audit Dependencies
Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
manifestecosystemdependencies已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
com.datakoot官方發布者
一個託管、唯讀的 MCP 伺服器，讓助理查詢 Base 鏈上資料：地址餘額、ERC-20 代幣資訊、Gas 價格與交易狀態。
com.datakoot官方發布者
Koot by Datakoot 是遠端 MCP 伺服器，讓助理一次呼叫就能取得相依性風險、美國上市公司、網域與美國地點的簡報。
com.datakoot官方發布者
免金鑰的遠端 MCP 伺服器，讓助理取得美國天氣預報、即時天氣、警報、地震、海拔與地址地理編碼，資料來自政府公開資料源。
com.datakoot官方發布者
一個遠端 MCP 伺服器，讓助理免金鑰即可存取 SEC EDGAR 資料：公司身分、申報文件、全文檢索、XBRL 財務資料與內部人交易。
com.datakoot官方發布者
一個遠端 MCP 伺服器，為助理提供 npm、PyPI 與 crates.io 的套件情報，方便在安裝或推薦相依套件前先做評估。
claude mcp add --transport http security-intel https://security.datakoot.com/mcpcurl -s https://security.datakoot.com/mcp \ -H 'content-type: application/json' \ -H 'accept: application/json, text/event-stream' \ -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'