CVE Intelligence MCP Server with EPSS Scoring

Overview

This MCP (Model Context Protocol) server provides multi-source CVE intelligence, exploit discovery, and EPSS risk scoring as an embeddable tool for security workflows. It aggregates vulnerability metadata from public feeds and local caches, enriches CVE records with exploit indicators and evidence, and attaches EPSS (Exploit Prediction Scoring System) risk estimates to each finding. The server exposes that intelligence via a small MCP-compatible HTTP interface so agents and automation engines can ask for context at runtime.

The server is useful when you need an automated, queryable source of vulnerability risk and exploitability signals. Security researchers, SOAR playbooks, red/blue automation, and lightweight vulnerability scanners can all use the service to augment alerts with exploit likelihood, canonical CVE facts, and cross-referenced evidence from multiple sources.

Features

• Aggregates CVE metadata from multiple sources (NVD, vendor advisories, public exploit repositories).
• EPSS scoring: add exploit probability / risk estimates to CVE records.
• Exploit discovery: surface known proof-of-concept, exploit repos, and references.
• Lightweight MCP-compatible HTTP API for tool-style calls from agents and orchestrators.
• Local caching and optional persistent datastore for performance and offline use.
• Configurable data sources and refresh intervals.
• JSON responses designed for machine consumption; includes evidence, confidence, and source attribution.

Installation / Configuration

Prerequisites: Docker or a recent Python/Node runtime (depending on the distribution). Basic steps below show a Docker-based deployment and a local dev run.

Clone the repository:

git clone https://github.com/gnlds/mcp-cve-intelligence-server-lite.git
cd mcp-cve-intelligence-server-lite

Run with Docker:

# build (optional) and run
docker build -t mcp-cve-intel .
docker run -d \
  --name mcp-cve-intel \
  -p 8080:8080 \
  -e PORT=8080 \
  -e DATA_DIR=/data \
  -e EPSS_FEED_URL=https://example.com/epss.csv \
  -v $(pwd)/data:/data \
  mcp-cve-intel

Or use Docker Compose (example docker-compose.yml):

version: "3.8"
services:
  mcp-cve-intel:
    image: mcp-cve-intel:latest
    ports:
      - "8080:8080"
    environment:
      PORT: "8080"
      DATA_DIR: "/data"
      EPSS_FEED_URL: "https://example.com/epss.csv"
    volumes:
      - ./data:/data

Common environment variables

Configuration file (example config.yml):

server:
  port: 8080
data:
  path: "/data"
sources:
  - type: nvd
    api_key: "${NVD_API_KEY}"
  - type: epss
    feed_url: "${EPSS_FEED_URL}"
refresh_interval: 86400

Available Resources

• HTTP API (MCP-style tool interface) — accepts JSON tool invocations and returns structured results with evidence and EPSS score.
• Local cache and datastore for historical lookups and offline queries.
• Logs and basic metrics (requests, cache hits/misses, source refresh status).
• Example clients: small curl examples and SDK snippets in the repo to demonstrate integration.

Example “tool” request (generic MCP-style JSON):

curl -X POST http://localhost:8080/mcp/run \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "cve_intelligence",
    "input": {
      "query": "CVE-2021-44228"
    }
  }'

Example response (truncated):

{
  "tool": "cve_intelligence",
  "result": {
    "cve_id": "CVE-2021-44228",
    "summary": "Apache Log4j2 JNDI lookup vulnerability",
    "epss_score": 0.98,
    "exploit_indicators": [
      {"type": "poC", "url": "https://example.com/poc", "confidence": "high"}
    ],
    "sources": ["nvd", "exploit-db", "vendor-advisory"]
  }
}

Use Cases

• Enrich alerts in SIEM/SOAR: When an alert contains a CVE or software identifier, call the MCP server to attach EPSS probability, exploit evidence links, and authoritative metadata before routing or escalating.
• Prioritization and triage: Use EPSS scores to rank patching or mitigation queues, focusing remediation on vulnerabilities with higher exploit likelihood.
• Autonomous agents: Security agents or orchestration bots can request the server for contextual intelligence during discovery runs, enabling on-the-fly decisions (block, patch, monitor).
• Research and dashboards: Analysts can query aggregated evidence across sources to identify trends, track exploit emergence, and build dashboards that combine EPSS with exploit sightings.
• CI/CD gating: Integrate into CI pipelines to flag vulnerable dependencies with high EPSS probability and attached exploit references before deployment.

Tips and Best Practices

• Keep the EPSS feed refreshed on a regular schedule; EPSS values change as new exploit activity is observed.
• Combine EPSS with other signals (asset exposure, CVSS, business criticality) rather than using EPSS alone for irrevocable decisions.
• Use local caching to reduce external API usage and improve response latency for high-frequency queries.
• Attribute source data in your response downstream so analysts can validate findings.

For full implementation details, API schema, and example integrations, see the project repository on GitHub: https://github.com/gnlds/mcp-cve-intelligence-server-lite