Security Intel MCP
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
claude mcp add --transport http security-intel-mcp 'https://security.datakoot.com/mcp'{
"mcpServers": {
"security-intel-mcp": {
"type": "http",
"url": "https://security.datakoot.com/mcp"
}
}
}Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
Contents
Security Intel MCP — by Datakoot
Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.
Tools
| Tool | What it does | Source |
|---|---|---|
cve_lookup | CVE summary: description, CVSS score & severity, CWE, references, plus whether it is actively exploited (CISA KEV) and its exploit probability (EPSS) | NVD (NIST), CISA KEV, FIRST EPSS |
known_exploited | Is a CVE on CISA's Known Exploited Vulnerabilities catalog? Or list the newest exploited CVEs (filter by vendor, product or ransomware use) | CISA KEV |
epss_score | Exploit probability (0–1) and percentile for one or many CVEs: the chance each is exploited in the next 30 days | FIRST EPSS |
package_vulnerabilities | Known vulnerabilities for a package/version | OSV.dev |
audit_dependencies | Audit a whole package.json (or dependency list) in one call | OSV.dev |
No API keys required for any tool.
Quick start
claude mcp add --transport http security-intel https://security.datakoot.com/mcpOr point any MCP client at https://security.datakoot.com/mcp.
Try it in 10 seconds — no key, no signup
Paste this into a terminal:
curl -s https://security.datakoot.com/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.
Or point any MCP client at the URL and just ask your agent, in plain language:
- "Is CVE-2021-44228 something I need to worry about?"
- "Which of these CVEs is actually being exploited right now?"
- "Audit my package.json for known vulnerabilities before I deploy."
Data & attribution
Vulnerability data comes from the National Vulnerability Database (NIST — US public domain), CISA's Known Exploited Vulnerabilities catalog (US public domain), FIRST EPSS and OSV.dev (CC-BY 4.0), the same open sources used by scanners like Trivy and Grype.
Part of Datakoot — keyless intelligence APIs for AI agents.
Frequently asked questions
What is Security Intel MCP?
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
How do I install Security Intel MCP?
It runs as a remote server. In Claude Code: claude mcp add --transport http security-intel-mcp 'https://security.datakoot.com/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.
Does Security Intel MCP need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is Security Intel MCP open source?
Yes. Its code is on GitHub under the MIT license.
Who maintains Security Intel MCP?
It is published by datakoot. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.