Security Intel MCP — Claude Code MCP server: CVE lookups
Five MCP tools that let your agent check CVEs and audit dependencies mid-task. No API keys involved.
claude mcp add --transport http cve-vulnerability-lookup https://security.datakoot.com/mcpWhat Security Intel MCP does
Point your MCP client at the remote server and the agent gets five callable tools. cve_lookup returns one CVE with its description, CVSS score and severity, CWE, and references, then adds whether CISA KEV lists it as exploited and what EPSS says about the odds. known_exploited answers the narrower question — is this CVE in the KEV catalog — or hands back the newest exploited entries filtered by vendor, product or ransomware use. epss_score gives exploit probability and percentile for a single CVE or a batch, covering the next 30 days.
Dependency work runs on OSV.dev. package_vulnerabilities looks up known issues for a package and version; audit_dependencies takes a whole package.json or a dependency list in one call. Handy right before a deploy when you would rather not leave the editor.
Sources are the open ones: NVD from NIST, the CISA KEV catalog, FIRST EPSS and OSV.dev. Nothing here asks for an API key or a signup. The server is remote and speaks HTTP, so there is no local install step — you only add https://security.datakoot.com/mcp to your client config.
What it helps with
- check a single CVE and see whether it is exploited in the wild
- pull the newest CVEs tied to ransomware campaigns
- score exploit probability for a list of CVEs over 30 days
- audit
package.jsonfor known vulnerabilities before deploying - find vulnerable versions of a specific package
Example prompts for the agent
- Look up CVE-2021-44228 and tell me how bad it is
- Which of these CVEs are actually being exploited right now?
- Audit my
package.jsonfor known vulnerabilities before I deploy
How to install Security Intel MCP
Platform CLI: remote server
claude mcp add --transport http cve-vulnerability-lookup https://security.datakoot.com/mcpPlatform CLI: remote server
codex mcp add security-intel-mcp --url https://security.datakoot.com/mcpConfig file
{
"mcpServers": {
"security-intel-mcp": {
"url": "https://security.datakoot.com/mcp"
}
}
}Config file
{
"servers": {
"security-intel-mcp": {
"type": "http",
"url": "https://security.datakoot.com/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http security-intel-mcp https://security.datakoot.com/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Security Intel MCP
How do I install Security Intel MCP in Claude Code?
Run claude mcp add --transport http security-intel-mcp https://security.datakoot.com/mcp. The server is remote, so there is nothing to install locally.
What does Security Intel MCP do?
It exposes five tools to your agent: cve_lookup, known_exploited, epss_score, package_vulnerabilities and audit_dependencies. The first three cover CVE intelligence from NVD, CISA KEV and EPSS; the last two check dependencies through OSV.dev.
Do I need an API key?
No. None of the tools require a key, and there is no signup — the data comes from open sources.
