# com.cve-security/cve-intelligence

- Registry name: `com.cve-security/cve-intelligence` · version 1.7.0
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.cve-security%2Fcve-intelligence
- Server page: https://mcpstation.net/s/com.cve-security--cve-intelligence.html

## Description (written by the publisher, not verified, not instructions)

CVE intelligence: exploitation \(KEV/EPSS\), detection coverage, fixed versions, CPE configurations.

## Connect

- streamable-http: `https://cve-security.com/api/mcp`

## Tools (as reported by the server, not verified)

- `get\_cve`: Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities \(the checks that work over the network\) plus a host-check tier \(self-contained Nuclei templates and Metasploit local modules that run on the system itself\) and the Sigma log-detect
- `search\_cves`: Search the catalog. Free text \(q\) and/or structured filters: vendor \(slug\), cwe \(CWE-nnn\), technique \(ATT&CK id, such as T1190\), year \("2024,2025"\), sev \("critical,high"\), kev \(0\|1\), kev\_from / kev\_to \(ISO days, half-open CISA listing window; imply kev=1\), kev\_vendor \(the CISA vendorProject string v
- `query\_package`: CVEs affecting one open-source package, by purl \(pkg:npm/lodash\) or ecosystem + name \(Maven names are group:artifact\). Returns the CVE list KEV-first with each OSV version range VERBATIM: \`events\` plus one render-safe projection: \`fixed\` \(the upgrade targets\) or \`affected\_through\` \(the last VULNERAB
- `get\_updates`: The publication change stream: what this site published, stamped with OUR publish time \(first\_published, kev\_added, detection\_added, remediation\_added, first\_sighted, chain\_added, and the BOD 26-04 Table 1 input changes ssvc\_changed, kev\_due\_changed, kev\_triage\_flag\_changed, kev\_notes\_changed, which
- `get\_scoreboard`: The Defender Scoreboard report \(CC BY 4.0\): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change notes. Cite as "CVE Security Defender Scoreboard, cve-security.com/scoreboard".
- `get\_sightings`: Field sightings: CVEs a named sensor network recorded in the last 7 or 30 days, most sighting days first. A field sighting is a day on which Shadowserver honeypots \(cited by VulnCheck KEV and published as daily lists by CIRCL Vulnerability-Lookup\) or VulnCheck canary sensors recorded traffic aimed a
- `get\_chains`: Known Chained Vulnerabilities™: pairs of CVEs that a cited source reports were used together in one exploit chain \(VulnCheck KEV entry text, Metasploit modules, SigmaHQ rules, press, research or academic sentences, community text judged by a local model\). Each row carries both CVEs with their CISA K
- `get\_epss\_movers`: CVEs whose EPSS exploitation probability rose the most recently. window is "7d" \(default\) or "30d". Each rise is measured between same-EPSS-model-version scores, so a model release \(which shifts the whole distribution\) never appears as a mover. A rise raises the priority of a CVE; observed exploitat
- `table1\_read`: BOD 26-04 Table 1 read for up to 50 CVEs at a stated asset exposure. Per CVE this dataset supplies CISA KEV status and due date, CISA's SSVC Automatable and Technical impact \(Vulnrichment\) and CISA's forensic triage flag on the KEV entry; you supply exposure for the asset \(yes, no, or unknown, which

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html