# cve-intelligence MCP server

CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.

## Links
- Registry page: https://www.getdrio.com/mcp/com-cve-security-cve-intelligence
- Website: https://cve-security.com

## Install
- Endpoint: https://cve-security.com/api/mcp
- Auth: Not captured

## Setup notes
- Remote endpoint: https://cve-security.com/api/mcp

## Tools
- get_cve - Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities plus the Sigma log-detection layer, per-product fixed versions (fixed = first patched build; affected_through = last VULNERABLE build, never a fix), news/community coverage, intelligence summary. No key required over MCP; an API key on the HTTP request (Authorization: Bearer cvs_live_…) is honoured for attribution. Absence semantics: a null field means this dataset holds no such record, never that none exists. Endpoint: https://cve-security.com/api/mcp
- search_cves - Search the catalog. Free text (q) and/or structured filters: vendor (slug), cwe (CWE-nnn), year ("2024,2025"), sev ("critical,high"), kev (0|1), ransomware (0|1), detect (0|1 — detection content we track), fix (0|1 — fix=0 means computed-and-none-held, never "no fix exists"), epss_gte (0..1), page, limit (1..50). Filter-only queries return the /browse slice ordered KEV-first then EPSS. Endpoint: https://cve-security.com/api/mcp
- get_updates - The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue. Events for withdrawn CVE ids are omitted. Endpoint: https://cve-security.com/api/mcp
- get_scoreboard - The Defender Scoreboard report (CC BY 4.0): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change notes. Cite as "CVE Security Defender Scoreboard, cve-security.com/scoreboard". Endpoint: https://cve-security.com/api/mcp

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: com.cve-security
- Version: 1.3.0
- Runtime: Streamable Http
- Transports: HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: Aug 3, 2026
- Source: https://registry.modelcontextprotocol.io