# Security Intel MCP

Five MCP tools that let your agent check CVEs and audit dependencies mid-task. No API keys involved.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: datakoot
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/datakoot/security-intel-mcp
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/security-intel-mcp

## What it does

Point your MCP client at the remote server and the agent gets five callable tools. `cve_lookup` returns one CVE with its description, CVSS score and severity, CWE, and references, then adds whether CISA KEV lists it as exploited and what EPSS says about the odds. `known_exploited` answers the narrower question — is this CVE in the KEV catalog — or hands back the newest exploited entries filtered by vendor, product or ransomware use. `epss_score` gives exploit probability and percentile for a single CVE or a batch, covering the next 30 days.

Dependency work runs on OSV.dev. `package_vulnerabilities` looks up known issues for a package and version; `audit_dependencies` takes a whole `package.json` or a dependency list in one call. Handy right before a deploy when you would rather not leave the editor.

Sources are the open ones: NVD from NIST, the CISA KEV catalog, FIRST EPSS and OSV.dev. Nothing here asks for an API key or a signup. The server is remote and speaks HTTP, so there is no local install step — you only add `https://security.datakoot.com/mcp` to your client config.

## Requirements
- Remote server: `https://security.datakoot.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http cve-vulnerability-lookup https://security.datakoot.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add security-intel-mcp --url https://security.datakoot.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "security-intel-mcp": {
            "url": "https://security.datakoot.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "security-intel-mcp": {
            "type": "http",
            "url": "https://security.datakoot.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http security-intel-mcp https://security.datakoot.com/mcp
```

## When to use it
- check a single CVE and see whether it is exploited in the wild
- pull the newest CVEs tied to ransomware campaigns
- score exploit probability for a list of CVEs over 30 days
- audit `package.json` for known vulnerabilities before deploying
- find vulnerable versions of a specific package

## Example prompts
- Look up CVE-2021-44228 and tell me how bad it is
- Which of these CVEs are actually being exploited right now?
- Audit my `package.json` for known vulnerabilities before I deploy

## Similar
- [dependencies-audit](https://affpapa.org/en/nevibecode/skills/dependencies-audit.md) — skill · 1900 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [dependency-scan](https://affpapa.org/en/nevibecode/skills/dependency-scan.md) — skill · 355 installs
- [infynon-pkg](https://affpapa.org/en/nevibecode/plugins/infynon-pkg.md) — plugin · ★ 5
- [sparkfinderoven-r01-security-compliance-skills](https://affpapa.org/en/nevibecode/skills/sparkfinderoven-r01-security-compliance-skills.md) — skill · 729 installs
- [ghost-scan-deps](https://affpapa.org/en/nevibecode/skills/ghost-scan-deps.md) — skill · 4300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md