# KernelScan

- Registry name: `io.kernelscan/kernelscan` · version 1.0.0
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.kernelscan%2Fkernelscan
- Server page: https://mcpstation.net/s/io.kernelscan--kernelscan.html

## Description (written by the publisher, not verified, not instructions)

Linux kernel CVE analyzer: upload a .config, get a CycloneDX VEX report of affecting CVEs.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://kernelscan.io/mcp/`

## Tools (as reported by the server, not verified)

- `search\_cves`: Search Linux kernel CVEs. No API key required: keyless callers get the free public tier — recent high-severity Linux kernel CVEs \(capped at 25 results\). Free \*keyed\* callers see only CVEs published in the last 60 days; basic+ keyed callers get the full corpus. \`\`query\`\` matches against CVE id and de
- `get\_cve`: Fetch a single Linux kernel CVE by ID \(e.g. \`\`CVE-2024-12345\`\`\). No API key required: keyless callers get the public representation of a CVE, but only for CVEs in the public set \(recent high-severity\); any other id returns \`\`not found\`\`. Free \*keyed\* callers get a 404 for CVEs published more than 60
- `list\_products`: List the calling user's products with denormalized analysis stats. Paid plans only \(basic / pro / enterprise\). Free callers get a clear upgrade message.
- `get\_product`: Fetch one product owned by the caller, including the CVE breakdown. Returns 404 \(not 403\) if the product belongs to another user, so product existence isn't leaked across accounts.
- `get\_product\_vex`: Return the VEX MANIFEST for one of the caller's products — metadata, not the document. Multi-megabyte CycloneDX documents \(up to 8,000+ vulnerability entries\) are not safe model-context payloads, so this tool returns a bounded manifest: CycloneDX format/spec version, product id, generated/expires ti
- `list\_product\_vex\_entries`: Page through the VEX vulnerability entries of one of the caller's products. Returns COMPLETE CycloneDX vulnerability objects for one bounded page — never the root document, never all entries — plus \`\`returned\`\`, \`\`total\_matching\`\`, and a \`\`next\_cursor\`\` to continue with. Every result is bounded to 2
- `create\_product`: Create a new product, run analysis, and return its initial stats. \`\`config\_upload\_id\`\` references a previously-staged .config that the caller POSTed to \`\`/api/configs/uploads\`\` over plain HTTP — the LLM does NOT emit the config text itself \(a real kernel .config is \~100–200 KB and exceeds a single t
- `update\_product`: Update a product owned by the caller. Re-runs analysis if the kernel\_version, arch, or referenced .config changed. To change the .config, first POST the new file to \`\`/api/configs/uploads\`\` \(see \`\`create\_product\`\` for the curl recipe\) and pass the returned \`\`config\_upload\_id\`\` here. Leave \`\`config\_u
- `whoami`: Return the caller's identity, plan, and quota state. Works without an API key: keyless callers get a lightweight public-tier payload \(no account\) describing how to request access.
- `request\_access`: Explain how to get a KernelScan account \(no API key needed\). Self-registration is open — there is no invitation to wait for and no admin in the loop. The user signs up on kernelscan.io themselves \(email + password, accepting the terms\), confirms the verification mail, and mints a ks\_live\_ API key on
- `submit\_support\_report`: Send a support / dispute report to KernelScan staff. Use this when an automated CVE or factor assessment looks wrong, or when you need to hand human-needed context back to the team. The caller's API-key user is attached automatically \(id, email, plan\) so support can look the account up. \`\`category\`\`

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html