CISA Vulnerability Checker MCP Server

What is CISA Vulnerability Checker MCP Server?

CISA Vulnerability Checker MCP Server is a Model Context Protocol (MCP) server that provides real‑time access to CISA’s Known Exploited Vulnerabilities (KEV) catalog. It enables security analysts and developers to check individual CVEs, retrieve recent entries, and integrate vulnerability data into Claude or Cursor workflows.

How to use CISA Vulnerability Checker MCP Server?

Add the server to your Claude desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.json) using the remote endpoint https://amcipi.com/cisa-kev/mcp. Alternatively, clone the repository and run locally with uvicorn or Docker. Use the CLI commands cisa-vuln-checker check-cve <CVE_ID> and cisa-vuln-checker recent-cves --days 7 for quick checks.

Key features of CISA Vulnerability Checker MCP Server

• Real‑time CVE checking and monitoring
• Integration with Claude for enhanced security analysis
• Access to the complete CISA KEV catalog
• REST API endpoints for health, status, and CVE lookups
• CLI commands for recent and specific vulnerability checks
• Available as a hosted endpoint or self‑hosted installation

Use cases of CISA Vulnerability Checker MCP Server

• Querying a specific CVE during incident response
• Monitoring newly added exploited vulnerabilities on a daily or weekly basis
• Automating vulnerability checks in CI/CD pipelines using CLI or REST API
• Embedding CISA KEV data into Claude‑powered security assistants

FAQ from CISA Vulnerability Checker MCP Server

What data does the server access?

It accesses CISA’s Known Exploited Vulnerabilities (KEV) catalog in real time through the official CISA feed.

How do I configure it with Claude?

Add the remote MCP endpoint https://amcipi.com/cisa-kev/mcp to your Claude desktop configuration under mcpServers, using npx mcp-remote as the command.

Can I run it locally?

Yes. You can clone the repository, install dependencies, and run the server with uvicorn cisa_vuln_checker.server:app or via Docker. No external API key is required.

What transport does the server use?

The server uses a standard HTTP‑based MCP transport. The hosted endpoint is available at https://amcipi.com/cisa-kev/.

Are there any usage limits mentioned?

The documentation does not specify any usage limits for the hosted or self‑hosted versions.