skills.rest
reason-machines
reason-machinesOFFICIAL
Explore all skills by this author →
Website𝕏@reasonmachinesGitHub

cve-mcp-server-security-intelligence

Queries 21 security APIs to analyze CVEs, exploits, IP reputation, and malware indicators.

7|2|Updated May 16, 2026
Search Tags:#CVE#MCP server#vulnerability analysis#threat intelligence#risk scoring#epss#security research
One-click install
npx skills add https://github.com/reason-machines/mcp-skills --skill cve-mcp-server-security-intelligence-reason-machines
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cve-mcp-server-security-intelligence
Source: https://github.com/reason-machines/mcp-skills/tree/main/skills/cve-mcp-server-security-intelligence
Command: npx skills add https://github.com/reason-machines/mcp-skills --skill cve-mcp-server-security-intelligence-reason-machines

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts must manually query dozens of separate databases (NVD, EPSS, CISA KEV, Shodan, VirusTotal) to triage vulnerabilities and investigate threats, which is slow and error-prone. This Skill consolidates 27 security intelligence tools into one MCP server so Claude can perform complete vulnerability research and threat analysis in a single conversation. ## Core Features & Use Cases - Vulnerability Intelligence: Look up CVE details from NVD, get EPSS exploitation probability scores, and check CISA KEV status for known exploited vulnerabilities. - Composite Risk Scoring: Calculate 0-100 risk scores combining CVSS, EPSS, KEV status, and PoC availability, then prioritize batches of CVEs for patching. - Threat & Network Intelligence: Check IP reputation via AbuseIPDB and GreyNoise, look up hosts in Shodan, and analyze hashes, URLs, and domains through VirusTotal, MalwareBazaar, and ThreatFox. - Use Case: When a scan returns 15 CVEs, ask Claude to prioritize them by risk. The server fetches CVSS, EPSS, and KEV data for each, ranks them, and generates an executive markdown report with remediation timelines. ## Quick Start Install the server with pipx install cve-mcp-server, add it to your Claude Desktop config with your NVD API key, then ask Claude to look up CVE-2021-44228 and calculate its risk score.

Frequently Asked Questions about cve-mcp-server-security-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a CVE is actively exploited?▼

Use the check_kev_status tool to query the CISA Known Exploited Vulnerabilities catalog, which confirms active exploitation and ransomware use. Combine it with get_epss_score for exploitation probability and search_exploits to find public proof-of-concept code on GitHub.

How to prioritize a list of CVEs for patching?▼

Call prioritize_cves with up to 20 CVE IDs to get a ranked list by composite risk score. The score combines CVSS base severity, EPSS exploitation probability, CISA KEV status, and PoC availability into a single 0-100 value.

What API keys does the CVE MCP server require?▼

No API keys are strictly required since tools degrade gracefully, but NVD_API_KEY is highly recommended to raise rate limits from 5 to 50 requests per 30 seconds. VirusTotal, Shodan, GreyNoise, AbuseIPDB, and GitHub tokens unlock additional tools.

Can I look up private IP addresses with Shodan or AbuseIPDB?▼

No, the network intelligence tools intentionally block RFC 1918 private addresses like 10.x, 172.16.x, and 192.168.x to prevent internal network scanning. Only public IP addresses are accepted by lookup_ip_reputation, check_ip_noise, and shodan_host_lookup.

Why does the CVE MCP server return rate limit errors from NVD?▼

NVD limits unauthenticated requests to 5 per 30 seconds. Set NVD_API_KEY in your Claude Desktop config to raise this to 50 per 30 seconds, and use bulk_cve_lookup instead of repeated single lookups to reduce request volume.

Why is the EPSS score zero for a newly published CVE?▼

EPSS scores update daily, so CVEs published within the last 24-48 hours may not have scores yet. A score of 0.0 is also a valid result meaning less than 0.1% exploitation probability, not an error.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

alert-triage

Automate SIEM/EDR alert triage with validation, enrichment, and verdict decisions.

Community
Intermediate
starwreckntxstarwreckntx

Vulnerability Management Agent

Track vulnerabilities across assets using CVE/CVSS standards and CVSS scoring.

Community
Basic
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
armanzeroeightarmanzeroeight
29

image-security-scanner

Scan Docker images for vulnerabilities, outdated packages, and misconfigurations.

Community
Intermediate