English Français العربية

io.github.kimmawla/vuln-triage-mcp

السجل الرسمي الأمن

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

PYPI package vuln-triage-mcp
Claude Code 
claude mcp add vuln-triage-mcp -- uvx vuln-triage-mcp==0.1.0
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "vuln-triage-mcp": {
            "command": "uvx",
            "args": [
                "vuln-triage-mcp==0.1.0"
            ]
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. vuln-triage-mcp
  2. Why this exists
  3. Quick start
  4. Try it
  5. Tools
  6. How scoring works
  7. Reliability and limits
  8. Security
  9. Evaluation
  10. Data sources and attribution
  11. Development
  12. License

vuln-triage-mcp

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

Why this exists

Two or three sentences. CVSS alone ranks by severity, not by likelihood of exploitation. This server adds exploit probability (EPSS) and known exploitation (KEV), and shows its reasoning. Example: a CVSS 9.8 nobody exploits ranks below a CVSS 8.8 that is being exploited in the wild.

Quick start

Claude Code

claude mcp add vuln-triage -- uvx vuln-triage-mcp

Claude Desktop / other clients

JSON config snippet using uvx. Requires: Python 3.12+, no API keys.

Try it

Three example prompts and what to expect:

  • "Which is most urgent: CVE-2021-44228, CVE-2023-4863, CVE-2019-10744?"
  • "Is lodash 4.17.15 vulnerable? What should I upgrade to?"
  • "Is CVE-XXXX actively exploited?"

Tools

ToolArgsUse it whenPrefer another when
lookup_vulnerabilityvuln_idraw advisory details for one CVE/GHSAuser wants prioritization -> triage_vulnerability
find_vulns_for_packagename, ecosystem, version="""what vulns affect package X (version Y)"user already has an ID
get_epss_scorecve_idexploit-probability onlyuser wants overall priority -> triage_vulnerability
check_known_exploitedcve_id"is this exploited in the wild" (CISA KEV)same
triage_vulnerabilityvuln_idany "how urgent / what should I fix first" questionraw details only -> lookup_vulnerability

How scoring works

  • Formula: CVSS (base) x 40 + EPSS x 35 + KEV +25; KEV-listed floors at 80
  • Buckets: see the table below
  • Missing data: component omitted, named in reasoning, lowers confidence
  • Link to docs/scoring-spec.md
BucketWhen
criticalscore >= 80, or listed in CISA KEV (always floored to 80, whatever the confidence)
highscore 60-79
mediumscore 40-59
lowscore < 40
unknownnot KEV-listed, and either no CVSS severity or low confidence (0-1 of 3 signals). Too little data to classify; the score is still returned, and reasoning names what is missing. Not a low-risk verdict.

unknown takes precedence over high, medium, and low; it never applies to a KEV-listed vulnerability.

Reliability and limits

  • Partial results: if EPSS or KEV fails, the result names the missing source
  • Truncation: truncated, found_count vs returned_count, ranking_note
  • Stale KEV cache: stale and catalog_fetched_at
  • Timeouts and retry policy (one line)
  • Package queries return at most 50 advisories, sorted by severity

Security

  • Advisory text is untrusted third-party content (prompt injection vector): sanitized, length-capped, returned under untrusted_text, and flagged to the model in the server instructions
  • Input validation on all IDs and ecosystems
  • No credentials required or stored; read-only calls to three public APIs
  • Reporting vulnerabilities in this project: SECURITY.md or email

Evaluation

Golden set: 17 entries (16 CVEs, 1 GHSA) with expected buckets, confidence, and ordering, recorded 10/21/2026. Result: 17/17 match on the recorded fixtures (uv run pytest tests/test_golden.py), and 17/17 against the live APIs on 10/21/2026 (uv run pytest -m live tests/test_golden.py). EPSS drifts daily, so the live run can diverge over time; re-record the fixtures with uv run python scripts/record_golden_fixtures.py when the golden set or scoring spec changes.

Data sources and attribution

OSV.dev, FIRST EPSS (cite per their usage terms), CISA KEV. Not affiliated with any of them.

Development

uv sync, uv run pytest, running the Inspector, live-test marker.

License

MIT

الأسئلة الشائعة

ما هو io.github.kimmawla/vuln-triage-mcp؟

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

كيف أثبّت io.github.kimmawla/vuln-triage-mcp؟

يعمل على جهازك. في Claude Code: claude mcp add vuln-triage-mcp -- uvx vuln-triage-mcp==0.1.0. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج io.github.kimmawla/vuln-triage-mcp إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل io.github.kimmawla/vuln-triage-mcp مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون io.github.kimmawla/vuln-triage-mcp؟

ينشره kimmawla. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.