Official MCP RegistryListed

Security Intel MCP

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

First seen 2 Oct 2026. Evidence as of 3 Oct 2026.

Tools

From an anonymous probe

Source listings

Each with its own history

Recorded changes

Since first seen

Tools

Tool	Description	Behaviour
audit_dependencies	Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.	Read-only
cve_lookup	Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.	Read-only
epss_score	Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.	Read-only
known_exploited	Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.	Read-only
package_vulnerabilities	List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.	Read-only

Source listings
Source	Listing	First seen	Last seen	Versions
Official MCP Registry	com.datakoot/cve-vulnerability-lookup	2 Oct 2026	3 Oct 2026	1

Vendors can correct facts, add competitors and ask for a re-run. Anyone can dispute a fact with evidence.