CVE MCP Server is an open-source Model Context Protocol server that turns Claude into a full-spectrum security analyst. With about 1,630 stars on GitHub and active development in 2026, it exposes 27 security intelligence tools across 21 APIs, so vulnerability questions can be answered in one conversation instead of across dozens of browser tabs.
Triaging a single CVE normally means querying the NVD for CVSS scores, EPSS for exploitation probability, CISA’s Known Exploited Vulnerabilities catalog for active exploitation status, and MITRE ATT&CK for context, plus sources like OSV, Shodan and VirusTotal. CVE MCP Server wraps all of these behind one MCP interface built with FastMCP, including a one-call triage_cve orchestrator that pulls the whole picture together and answers “should we patch this now?” with evidence. Security teams can connect it to Claude or other MCP clients and ask natural-language questions about the vulnerabilities affecting their stack, combining scoring, exploitation status and threat intelligence in a single workflow instead of manual lookups across portals.
CVE MCP Server is free and open source under the Apache-2.0 license. Some upstream data sources may require their own free or paid API keys, but the server itself charges nothing. You run it locally or on your own infrastructure as part of your security tooling.
Security analysts, DevSecOps engineers and vulnerability management teams who want conversational access to threat intelligence instead of manual lookups across NVD, KEV and a dozen other portals. It is built for Claude-first workflows but works with MCP clients generally.