ExploitDB MCP Server

What is ExploitDB MCP Server?

A Model Context Protocol server that provides access to ExploitDB functionality, developed by Cyreslab.ai. It enables AI assistants like Claude to query information about security exploits and vulnerabilities, enhancing cybersecurity research and threat intelligence.

How to use ExploitDB MCP Server?

Install Node.js v16+ and npm v7+, clone the repository, install dependencies with npm install, build with npm run build, create a .env file, initialize the database with npm run update-db, then run node build/index.js. Add the server to your MCP configuration (see JSON example in the README) to use it with Claude or other MCP-compatible assistants.

Key features of ExploitDB MCP Server

• Search exploits by keywords, CVE IDs, platform, and more
• Get detailed exploit information including code
• Look up all exploits related to a specific CVE
• Track recently added exploits
• View statistics on exploit distribution by platform, type, and year
• Automatic database updates scheduled every 24 hours
• 18 tools: search, compare, batch retrieval, export results, and more

Use cases of ExploitDB MCP Server

• Cybersecurity researchers querying exploit details for threat analysis
• Penetration testers finding relevant exploits for a given CVE or platform
• Security teams monitoring recently published exploits
• Analysts generating reports on exploit trends and statistics
• Automated workflows comparing multiple exploits side‑by‑side

FAQ from ExploitDB MCP Server

What are the system requirements?

Node.js v16 or higher and npm v7 or higher are required.

How do I update the exploit database?

Run npm run update-db. The initial update processes ~47,000 exploits and may take several minutes.

Where does the data come from?

The data is from the Exploit Database maintained by Offensive Security, downloaded as a CSV file or cloned from their GitLab repository.

How often does the database update automatically?

By default, the server checks for updates every 24 hours. This interval can be changed via the UPDATE_INTERVAL environment variable, or disabled by setting it to 0.

How many exploits are included?

The database typically contains over 46,000 exploits spanning from 1988 to the present, covering 60+ platforms.