One MCP server to stop the CVE browser-tab shuffle

What it does CVE MCP Server is a Python-based integration layer built on FastMCP that exposes 27 security tools to Claude. It queries vulnerability feeds, threat intel sources, and network recon APIs—then correlates the results into composite risk scores and prioritized recommendations. In short, it replaces the manual drudgery of checking NVD, EPSS, CISA KEV, and VirusTotal in separate browser tabs with a single natural-language interface.

The interesting bit The server doesn’t just dump raw JSON; it runs a composite risk engine that blends CVSS severity, EPSS exploitation probability, CISA KEV status, and proof-of-concept availability into a 0–100 score with evidence. The architecture is also sensibly locked down: outbound HTTPS only, no inbound ports, and private IP lookups are blocked.

Key highlights

• 27 tools across vulnerability intelligence, exploit search, network recon, and threat hunting
• SQLite caching and audit logging built in; Pydantic v2 handles validation
• Many core feeds (NVD, EPSS, MITRE ATT&CK, CISA KEV) work without API keys
• Bulk CVE lookup and automated triage prioritization for large patch queues
• Environment-variable-only API key handling; no inbound network exposure

Caveats

• Several advanced tools require paid or tiered third-party keys (Shodan, VirusTotal, GreyNoise, AbuseIPDB, CIRCL PDNS)
• The README references a roadmap and known limitations section, though the details were truncated in the provided source

Verdict Security teams and vulnerability researchers already using Claude Desktop or Claude Code will get the most value here. If you rely on traditional SIEM dashboards or don’t use an MCP client, this is just a very thorough Python wrapper around public APIs.