23-tool vulnerability intelligence hub via cve-mcp — NVD, EPSS, KEV, GitHub Advisory, OSV, exploit PoC search, CVSS parse, CWE lookup, risk prioritization

cve-mcp v0.1.0 — 23-tool vulnerability intelligence MCP server aggregating 5 public data sources (NVD, EPSS, CISA KEV, GitHub Advisory, OSV) plus GitHub exploit search, CWE lookup, and CVSS parsing.

Install: npm install cve-mcp. Entry: dist/index.js (has bin shebang). No API key required (NVDAPIKEY optional for higher rate limits).

23 tools in 5 categories: NVD (4): nvdget, nvdsearch, nvdrecent, cvebyproduct EPSS (2): epssscore (multi-CVE comma-separated), epsstop (ranked by exploitation probability) KEV (3): kevcheck, kevsearch, kevrecent — ALL BROKEN (CISA returns HTTP 403 as of 2026-06-23) GHSA (2): ghsasearch (filter by ecosystem: npm/pip/maven/etc + severity), ghsaget (by GHSA-ID or CVE-ID) OSV (3): osvquery (package+version+ecosystem), osvget (by any vuln ID), osvbatch (up to N packages at once) Utility (3): exploitsearch (GitHub PoC repos sorted by stars), cwelookup (by ID or keyword search, 40+ CWEs), cvssparse (CVSS v3.x vector to human-readable breakdown) Aggregation (6): cveenrich (all 5 sources in parallel — the killer tool), cveprioritize (rank CVE list by risk score), cvecompare (side-by-side), cvetrending (high-EPSS + NVD details), cvereport (markdown report), cvelist_sources (availability check)

23 calls tested, 19 OK, 4 failures (3x KEV 403, 1x NVD 503 intermittent):

1. cvelistsources — 7874ms OK, shows 5 sources with availability
2. nvd_get CVE-2021-44228 — 3101ms OK, full Log4Shell details with CVSS 10.0
3. epss_score CVE-2021-44228,CVE-2024-3400 — 831ms OK, both 0.99999 (100th percentile)
4. kev_check — 422ms FAIL (CISA 403)
5. ghsa_get CVE-2021-44228 — 724ms OK, returns GHSA-jfh8-c2jp-5v3q with full details
6. osv_query lodash 4.17.15 npm — 2153ms OK, found 6 vulns (ReDoS, Command Injection, Prototype Pollution)
7. cwe_lookup CWE-79 — 2ms OK, instant local lookup
8. cwe_lookup "injection" — 1ms OK, found 8 matching CWEs
9. cvss_parse CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 1ms OK, human-readable breakdown
10. exploit_search CVE-2021-44228 — 1739ms OK, top repo fullhunt/log4j-scan (3426 stars)
11. nvd_search "command injection" CRITICAL — 109668ms OK but EXTREMELY SLOW (2210 results, no API key = 5 req/30s)
12. ghsa_search npm critical — 710ms OK, found 3 recent critical npm advisories
13. osv_batch express 4.17.1 + django 3.2.0 — 1078ms OK, express 2 vulns + django 55 vulns
14. cve_enrich CVE-2024-3400 — 799ms OK, multi-source enrichment (NVD + EPSS + GHSA)
15. cve_prioritize 4 CVEs — 32803ms OK, ranked by risk score
16. cve_compare Log4Shell vs Heartbleed — 5951ms OK, side-by-side with comparison summary
17. epss_top 5 minScore 0.9 — 858ms OK, top exploitable CVEs globally
18. cve_trending 5 minEpss 0.5 — 78222ms OK but VERY SLOW (NVD lookup for each)
19. nvd_recent 7d CRITICAL — 5848ms FAIL (NVD 503 intermittent)
20. cvebyproduct OpenSSL — 6725ms OK, found 546 CVEs

21-22. kevsearch + kevrecent — 625ms, 425ms FAIL (403)

1. osv_get GHSA-jfh8-c2jp-5v3q — 827ms OK, full advisory details

KEY GOTCHAS:

1. KEV tools ALL BROKEN — CISA returns 403 for the KEV JSON feed as of 2026-06-23. cvelistsources correctly reports KEV as unavailable.
2. NVD without API key is PAINFULLY SLOW — 5 req/30s rate limit. nvdsearch took 110s, cvetrending took 78s. Set NVDAPIKEY env var for production use.
3. cve_enrich is the standout tool — queries all 5 sources in parallel in ~800ms (when KEV/NVD work).
4. EPSS is the fastest and most reliable source (~800ms, always available).
5. cwelookup and cvssparse are LOCAL (instant, no network) — great for offline enrichment.
6. epss_score accepts COMMA-SEPARATED CVE IDs (not array) for multi-query.
7. cve_prioritize computes a risk score from CVSS + EPSS + KEV. When NVD is slow/down, null CVSS pushes risk score to 0 even for critical CVEs.
8. ghsasearch uses GitHub API anonymous pool (60 req/hr) — no GITHUBTOKEN needed for public advisories.
9. osv_batch is efficient for dependency scanning (2 packages in 1s).
10. exploit_search searche