# KernelScan MCP server Linux kernel CVE analyzer: upload a .config, get a CycloneDX VEX report of affecting CVEs. ## Links - Registry page: https://www.getdrio.com/mcp/io-kernelscan-kernelscan - Website: https://kernelscan.io ## Install - Endpoint: https://kernelscan.io/mcp/ - Auth: Auth required by registry metadata ## Setup notes - Remote header: Authorization (secret) - The upstream registry signals required auth or secrets. - Remote endpoint: https://kernelscan.io/mcp/ - Header: Authorization ## Tools - search_cves - Search Linux kernel CVEs. No API key required: keyless callers get the free public tier — recent high-severity Linux kernel CVEs (capped at 25 results). Free *keyed* callers see only CVEs published in the last 60 days; basic+ keyed callers get the full corpus. ``query`` matches against CVE id and description (case-insensitive). ``severity`` filters by effective severity (``critical``/``high``/``medium``/``low``). ``cvss_min`` filters by effective CVSS score. ``published_after`` (ISO 8601) returns only CVEs newer than that date. Returns up to ``limit`` (max 100) CVEs, newest first. Endpoint: https://kernelscan.io/mcp/ - get_cve - Fetch a single Linux kernel CVE by ID (e.g. ``CVE-2024-12345``). No API key required: keyless callers get the public representation of a CVE, but only for CVEs in the public set (recent high-severity); any other id returns ``not found``. Free *keyed* callers get a 404 for CVEs published more than 60 days ago. AI risk-summary / analysis fields are included for any keyed user on CVEs in the public set, and for pro / enterprise on every assessed CVE. Endpoint: https://kernelscan.io/mcp/ - list_products - List the calling user's products with denormalized analysis stats. Paid plans only (basic / pro / enterprise). Free callers get a clear upgrade message. Endpoint: https://kernelscan.io/mcp/ - get_product - Fetch one product owned by the caller, including the CVE breakdown. Returns 404 (not 403) if the product belongs to another user, so product existence isn't leaked across accounts. Endpoint: https://kernelscan.io/mcp/ - get_product_vex - Return the CycloneDX 1.6 VEX document for one of the caller's products. Reads from the 24h ProductVexCache; if the cache is empty/expired the next call to ``get_product`` (or the REST endpoint) will regenerate it. Endpoint: https://kernelscan.io/mcp/ - create_product - Create a new product, run analysis, and return its initial stats. ``config_upload_id`` references a previously-staged .config that the caller POSTed to ``/api/configs/uploads`` over plain HTTP — the LLM does NOT emit the config text itself (a real kernel .config is ~100–200 KB and exceeds a single tool-call output budget). Workflow: 1. Caller / wrapper script: ``curl -H "Authorization: Bearer ks_live_..." \ -F "config_file=@.config" \ https://kernelscan.io/api/configs/uploads`` returns ``{config_upload_id, sha256, size_bytes, expires_at}``. 2. Pass that ``config_upload_id`` into this tool. Uploads are per-user, single-use, and expire 30 minutes after upload. Same tier gates as POST /api/products: free can't create products at all, basic is capped at 3 products, pro at 10. ``factor_ids`` are silently ignored unless the tier allows security factors (``pro``/``enterprise``). Re-using a product name returns 409. Endpoint: https://kernelscan.io/mcp/ - update_product - Update a product owned by the caller. Re-runs analysis if the kernel_version, arch, or referenced .config changed. To change the .config, first POST the new file to ``/api/configs/uploads`` (see ``create_product`` for the curl recipe) and pass the returned ``config_upload_id`` here. Leave ``config_upload_id`` as ``None`` to keep the existing .config. ``factor_ids=None`` leaves factor selections untouched; an empty list clears them. Same tier gates as PUT /api/products/{id}. Endpoint: https://kernelscan.io/mcp/ - whoami - Return the caller's identity, plan, and quota state. Works without an API key: keyless callers get a lightweight public-tier payload (no account) describing how to request access. Endpoint: https://kernelscan.io/mcp/ - request_access - Request an invitation to KernelScan from inside MCP (no API key needed). Use this when a keyless caller wants the full service. It records an invitation request and emails a confirmation; an admin reviews it and, if approved, sends an invitation code. This tool does NOT create an account or mint an API key — you finish signup (including accepting the terms) on the website after you receive the invitation. ``email`` is required. ``name`` and ``reason`` are optional context for the reviewer. The response is identical whether or not the email is already known, so it never reveals account state. Endpoint: https://kernelscan.io/mcp/ - submit_support_report - Send a support / dispute report to KernelScan staff. Use this when an automated CVE or factor assessment looks wrong, or when you need to hand human-needed context back to the team. The caller's API-key user is attached automatically (id, email, plan) so support can look the account up. ``category`` should be one of: - ``cve_assessment`` — wrong AI verdict / CVSS / CWE on a CVE - ``factor_assessment`` — wrong factor verdict for a product - ``bug`` — broken behavior in the API or UI - ``other`` — anything else ``cve_id`` / ``product_id`` / ``assessment_id`` are optional but recommended — they let support jump straight to the relevant row. Endpoint: https://kernelscan.io/mcp/ ## Resources Not captured ## Prompts Not captured ## Metadata - Owner: io.kernelscan - Version: 1.0.0 - Runtime: Streamable Http - Transports: HTTP - License: Not captured - Language: Not captured - Stars: Not captured - Updated: Jun 20, 2026 - Source: https://registry.modelcontextprotocol.io