# patch-tuesday MCP server Query Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment ## Links - Registry page: https://www.getdrio.com/mcp/io-github-jonnybottles-patch-tuesday - Repository: https://github.com/jonnybottles/patch-tuesday-mcp ## Install - Command: `uvx patch-tuesday-mcp` - Endpoint: https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp - Auth: Not captured ## Setup notes - Package: Pypi patch-tuesday-mcp v0.9.1 - Remote endpoint: https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp ## Tools - msrc_search (Search Microsoft Security Updates) - Search Microsoft security updates (Patch Tuesday) from the official MSRC API. Combines keyword search, CVE/KB lookup, and product/severity/exploitation filtering into a single flexible tool. All filter parameters are optional and can be combined. When no filters are provided, returns the most urgent vulnerabilities from the most recent *released* Patch Tuesday (CISA-KEV- listed or exploited first, then by EPSS exploitation probability, severity, and CVSS score). The upcoming month's document exists before its Patch Tuesday but only holds early Chromium/third-party and out-of-band entries; it is skipped by default and served only when requested via month=. Results are enriched with EPSS scores (FIRST.org daily exploit prediction, 0-1) and CISA KEV (Known Exploited Vulnerabilities) catalog data when available. Use this tool to: - Get the latest Patch Tuesday overview (include_stats=True, limit=0) - Browse the most urgent fixes this month (no filters) - Look up a specific CVE with full detail (cve="CVE-2026-41108") -- works across all months, returns KBs, affected products, CVSS, description, FAQs, EPSS score, and KEV status - Find which CVEs a KB article fixes (kb="5094123" or kb="KB5094123") -- scans recent months, or a specific month when combined with month= - Look up many KBs in one call (kb=["5094123", "KB5094127", ...], up to 30) -- e.g. a machine's installed-update list; returns one grouped per-KB result entry each, with per-KB found/not-found status - Check whether a KB has been superseded by newer patches (kb="5087538", include_chain=True) -- walks Microsoft-stated supersedence links - See what Microsoft has confirmed an update breaks (kb=..., include_known_issues=True) -- known issues from the KB's public support page: symptoms, workarounds, and the resolving update when stated - See what an update changes (kb=..., include_update_summary=True) -- the KB support page's summary and improvements highlights, beyond the security fixes already listed in the MSRC data - Find KEV-listed CVEs this month (kev=True) -- confirmed exploited, with federal remediation due dates - High exploitation probability (min_epss=0.5) -- EPSS >= 50% - Search by keyword (query="Exchange" or query="DNS spoofing") - Filter to a product (product="Windows Server 2022") -- partial match - Filter to a product watchlist (product_profile="identity-core", or products=["Exchange Server", "Windows Server"] / product_families=["Windows", "Azure"]) -- keeps vulns matching any listed product or family; matching is local and profiles never leave the host - Filter by severity (severity="Critical") -- Critical/Important/Moderate/Low - Find actively exploited vulnerabilities (exploited=True) - Find publicly disclosed zero-days (publicly_disclosed=True) - Filter by CVSS score (min_cvss=8.0) - Look at a past month (month="2026-Apr" or month="2026-04") - Combine filters (product="Exchange" + severity="Critical" + month="2026-05") - Search a historical range (query="HTTP.sys" + months_back=6, or start_month="2026-Jan" + end_month="2026-Jun") -- aggregates matching CVEs across released months with per-month trend counts - Paginate with offset (offset=10, limit=10 for page 2) Args: query: Optional keyword; case-insensitive match across CVE ID, title, description, component tag, and affected product names. cve: Optional CVE ID (e.g. "CVE-2026-41108"). Fast path: ignores other filters and returns full detail for that single CVE, searching across all months automatically. kb: Optional KB article number (e.g. "5094123" or "KB5094123") or a list of up to 30 of them for a batched lookup. Fast path: returns the CVEs fixed by that KB, scanning the most recent months (up to 6), or only the given month when month= is also set. A list input returns a grouped response instead: a results array with one entry per KB ("kb", "found", and on success the same body as a single-KB lookup; on a miss "error"/"error_kind"), deduplicated, order preserved. limit/offset apply per KB; other filters are ignored. Accepts numeric KB ids only (any malformed list entry fails the whole call); kb_articles in results may also contain non-KB vendor-fix labels such as "Release Notes", which cannot be looked up here. month: Optional monthly release to search, formatted "2026-Apr" or "2026-04". Defaults to the most recent release whose Patch Tuesday (second Tuesday of the month) has already occurred; pass the upcoming month explicitly to see its pre-release entries. Combined with kb=, restricts the KB lookup to that month. product: Optional product name filter (case-insensitive partial match against affected product names, e.g. "Windows Server 2022"). product_profile: Optional named watchlist (e.g. "identity-core") that expands locally into product/family matchers. Built-in profiles can be overridden/extended via a JSON file at MSRC_PROFILES_PATH. An unknown name returns an invalid_input error listing the available profiles. Profile contents are matched locally and never sent to MSRC, FIRST.org, CISA, or telemetry. products: Optional list of product-name partial matchers. A vulnerability is kept if any entry matches one of its affected products. product_families: Optional list of product-family partial matchers. A vulnerability is kept if any entry matches one of its product families. Combined with products/product_profile as a union (match any listed product OR family). severity: Optional maximum-severity filter. Valid values: Critical, Important, Moderate, Low. exploited: Optional filter for vulnerabilities known to be exploited in the wild (True) or not (False), per Microsoft's assessment. publicly_disclosed: Optional filter for publicly disclosed vulnerabilities. kev: Optional filter for CVEs on (True) or off (False) the CISA Known Exploited Vulnerabilities catalog. ransomware: Optional filter for CVEs whose CISA KEV entry reports known ransomware campaign use (True) or not / not on KEV (False). exploitation_likely: Optional filter on Microsoft's latest-release exploitation assessment: True matches "Exploitation More Likely" or "Exploitation Detected"; False matches everything else (including unassessed entries). Matching results include an exploitation_assessment field. cwe: Optional weakness filter; case-insensitive substring match against CWE entries (e.g. "CWE-416" or "use after free"). Matching results include their cwe list. min_epss: Optional minimum EPSS score (0-1), the probability of exploitation in the next 30 days (e.g. 0.5 for >= 50%). min_cvss: Optional minimum CVSS base score (0-10). attack_vector: Optional CVSS attack-vector filter, one of N (network), A (adjacent), L (local), P (physical). Matches the parsed CVSS v3.x vector; entries without a parseable vector are excluded. privileges_required: Optional CVSS privileges-required filter, one of N (none), L (low), H (high). user_interaction: Optional CVSS user-interaction filter, one of N (none), R (required). scope: Optional CVSS scope filter, one of U (unchanged), C (changed). include_chain: When True together with kb=, adds a supersedence_chain showing which KBs this KB replaces (newest to oldest), walked from Microsoft-stated supersedence links. Ignored without kb=. include_guidance: When True together with cve=, adds a guidance list to the CVE detail output with any Microsoft-provided mitigations, workarounds, and will-not-fix advisories (type/description/url). Omitted by default to keep responses lean. Ignored without cve=. include_references: When True, adds deterministic reference links (MSRC, NVD, EPSS, and KEV when listed) to each result row in month/KB/trend lists. CVE detail lookups always include them. include_kb_details: When True, kb_articles entries become full objects (per-KB url, fixed_build, supersedence, sub_type, and restart_required) instead of bare KB numbers; on cve= lookups it additionally adds restart_required to each KB entry. include_kev_details: When True, KEV-listed rows carry the full KEV entry (due_date, ransomware_use, required_action, vendor_project, product, vulnerability_name) instead of a boolean flag; on cve= lookups it extends the kev block with the extra catalog fields. include_known_issues: When True together with kb=, adds a known_issues block per KB with the issues Microsoft has publicly confirmed for that update (title, symptoms, workaround, and the resolving KB when stated), scraped best-effort from the KB's support page on support.microsoft.com. This reports what Microsoft has confirmed breaks -- it does not predict behavior in a specific environment. The block's status field is honest about coverage: "published" (issues listed), "none_published" (Microsoft publishes no known-issues data for this KB -- the norm for most non-Windows products; Windows cumulative/preview updates are the main source), or "unavailable" (the page could not be fetched or parsed; NOT the same as no issues). Attached even when the KB is not found in MSRC security releases (e.g. preview-only updates). Ignored without kb=. include_update_summary: When True together with kb=, adds an update_summary block per KB describing what the update changes, scraped best-effort from the same support.microsoft.com KB page: the page's Summary/Highlights text plus its Improvements bullet list (size-capped; truncated=True marks a capped block). The status field is honest like known_issues: "published" (a summary exists), "none_published" (Microsoft publishes no summary section for this KB), or "unavailable" (the page could not be fetched or parsed; NOT the same as no summary). Attached even when the KB is not found in MSRC security releases; combines freely with include_known_issues -- both blocks are served by a single fetch of the same page. Ignored without kb=. include_temporal: When True, cvss blocks gain the CVSS temporal score Microsoft publishes (exploit-code maturity adjusted). Applies to cve= detail and to list rows that carry a cvss block. list_months: When True, ignore other filters and return the catalog of available monthly releases (id, title, initial/current release dates, newest first) — useful for discovering valid month= values and spotting same-month revisions. format: Output format for a monthly/filtered search: "json" (default, most complete), "markdown", or "csv". "markdown" adds a prioritized triage briefing (executive summary + table) under a markdown key; "csv" adds a spreadsheet-ready table under a csv key plus a columns list. The JSON vulnerabilities list is always included. Ignored for cve=/kb= fast-path lookups. report: Optional report profile for format="markdown"/"csv". Currently only "triage" (the default rendering) is supported; reserved for future report shapes. force_refresh: When True, bypass the in-process caches for this request and re-fetch the MSRC document and EPSS/KEV enrichment from source. Use to pick up a same-day MSRC revision or fresh EPSS/KEV data. Only the data needed for this request is refreshed; unrelated cached months are left intact. include_freshness: When True (or when force_refresh is used), add a freshness block to the response reporting the cache age and TTL of the MSRC document and the EPSS/KEV enrichment data. months_back: Optional historical-trend control; search the N most recent released months (N >= 1) instead of a single month, aggregating matches with per-month counts. Mutually exclusive with start_month/end_month. Capped at 12 months per request. start_month: Optional start of a historical-trend range (e.g. "2026-Jan" or "2026-01"), inclusive. When end_month is omitted the range runs through the latest released month. Capped at 12 months. end_month: Optional end of a historical-trend range (inclusive); requires start_month (or months_back). Pre-release months are excluded. limit: Maximum number of results to return (default: 10, max: 100). Set to 0 with include_stats=True for a stats-only month overview. offset: Number of results to skip for pagination (default: 0). include_stats: When True, includes aggregate counts (by severity, impact, product family, exploited, KEV, publicly disclosed) for the filtered result set. Returns: Dictionary with: - month: Release ID (e.g. "2026-Jun") and title/release date - total_found: Number of vulnerabilities matching the filters - vulnerabilities: List of compact vulnerability summaries (up to limit) with epss_score and kev flag when available; full detail (epss_percentile, KEV due dates) returned for cve= lookups - filters_applied: Summary of which filters were used - stats: (only when include_stats=True) aggregate counts - supersedence_chain / chain_complete: (only for kb= lookups with include_chain=True) the walked chain, newest to oldest - known_issues: (only for kb= lookups with include_known_issues=True) per-KB block with status ("published" / "none_published" / "unavailable"), an issues list (title, symptoms, workaround, resolution, resolved_by) when published, a note otherwise, and the source_url of the Microsoft support page - update_summary: (only for kb= lookups with include_update_summary=True) per-KB block with status ("published" / "none_published" / "unavailable"), the page title, a summary string and an improvements list of what the update changes when published (truncated=True when size caps trimmed content), a note otherwise, and the source_url of the Microsoft support page - total_kbs / results: (only when kb= is a list) grouped batch output; results holds one entry per KB with kb, found, and either the single-KB response body or a per-KB error/error_kind, while the top-level total_found sums across all KBs - guidance: (only for cve= lookups with include_guidance=True) list of mitigation/workaround/will-not-fix advisories, when Microsoft provides them - format / markdown / csv / columns: (only when format="markdown" or "csv") the chosen format plus the rendered triage view; csv also carries the stable column-name list - freshness: (only with include_freshness=True or force_refresh=True) cache age/TTL for the MSRC document and EPSS/KEV enrichment - range / months_searched / trend: (only for historical-trend searches via months_back or start_month/end_month) the resolved month range, the number of months searched, and per-month aggregate counts (total, by_severity, exploited, publicly_disclosed, kev) - available_months: (only with list_months=True) the release catalog, newest first - error / error_kind: (only on failure) a message plus a category (invalid_input, not_found, upstream, internal) - note: (when relevant) explains month selection, e.g. that a newer pre-Patch-Tuesday document was skipped, or (with release_status="pre-patch-tuesday") that the requested month has not had its Patch Tuesday yet Endpoint: https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp ## Resources Not captured ## Prompts - monthly_triage - Monthly Patch Tuesday Triage Guided monthly identity/security triage using msrc_search: zero-days, CISA KEV, exploited, network/no-auth/no-UI criticals, identity-adjacent products, endpoint/Intune, and a briefing. Optionally scope to a product watchlist via product_profile. Arguments: product_profile, month ## Metadata - Owner: io.github.jonnybottles - Version: 0.9.1 - Runtime: Pypi - Transports: STDIO, HTTP - License: Not captured - Language: Not captured - Stars: Not captured - Updated: Jul 26, 2026 - Source: https://registry.modelcontextprotocol.io