cve-mcp-server MCP工具

Prerequisites

• Python 3.10+ (3.11 or 3.12 recommended)
• pip or uv package manager
• Git for cloning the repository
• A terminal with access to environment variables

3. Install dependencies

pip install -e .

With test dependencies

pip install -e ".[test]"

---

CIRCL Passive DNS — requires partner registration

CIRCL_PDNS_USER= CIRCL_PDNS_PASS=

Scenario 2: "Scan my Python requirements.txt"

You: Scan these dependencies: requests==2.28.0, flask==2.2.0, django==3.2.0, pillow==9.0.0, cryptography==37.0.0

→ scan_dependencies(ecosystem="PyPI", packages={...})
  Found 12 vulnerabilities across 4 packages

Claude's response: "Found 12 vulnerabilities across your packages. Immediate action: Django 3.2.0 (3 critical CVEs including SQL injection), Pillow 9.0.0 (heap overflow), cryptography 37.0.0 (OpenSSL chain). Upgrade to: django>=4.2.16, pillow>=10.3.0, cryptography>=42.0.0."

Testing requirements

• All new tools must have at least one offline test with mocked responses
• Risk score changes must include formula verification test cases
• Network tools must include a test verifying private IP blocking
• All tests must pass: pytest tests/ -v

---

📦 Installation

Step-by-step setup

```bash

Edit .env with your API keys (see API Keys Setup section below)

🔑 API keys setup

API keys are organized by priority — get the Tier 1 keys first for maximum coverage with free tools, then progressively add Tier 2 and Tier 3 as needed.

Basic setup

claude mcp add cve-mcp -- python -m cve_mcp.server

Step 1: Install (2 minutes)

git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server
python -m venv venv && source venv/bin/activate
pip install -e .

Ensure virtual environment is activated and package is installed

pip install -e . python --version # must be 3.10+ ```

Claude Desktop doesn't show the hammer icon (🔨) - Check for JSON syntax errors (no trailing commas) in your config - Use absolute paths — relative paths silently fail - Fully quit Claude Desktop (Cmd+Q / Alt+F4) and restart

Environment variables (.env.example)

```env

🚀 Quick start

💬 Usage examples

2. Create and activate a virtual environment

python -m venv venv

4. Copy and configure environment variables

cp .env.example .env

Tier 3: Optional (extended intelligence)

⚡ Zero-key start: Eight tools work without any API key — EPSS, CISA KEV, OSV.dev, MITRE ATT&CK, CWE lookups, CVSS parsing, Ransomwhere, and NVD (at reduced rate). You can start using the server immediately and add keys progressively.

---

⚙️ Configuration

Threat intelligence keys (all optional — tools degrade gracefully without them)

ABUSEIPDB_KEY= # https://www.abuseipdb.com/account/api VIRUSTOTAL_KEY= # https://www.virustotal.com/gui/join-us URLSCAN_KEY= # https://urlscan.io/user/signup SHODAN_KEY= # https://account.shodan.io/register

Optional overrides

CACHE_DB_PATH= # defaults to ~/.cve-mcp/cache.db AUDIT_LOG_PATH= # defaults to ~/.cve-mcp/audit.log REQUEST_TIMEOUT=30 # HTTP timeout in seconds MAX_RETRIES=3 # retries on transient errors ```

Claude Desktop configuration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "cve-mcp": {
      "command": "python",
      "args": ["-m", "cve_mcp.server"],
      "cwd": "/absolute/path/to/cve-mcp-server",
      "env": {
        "NVD_API_KEY": "your-key-here",
        "GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxxxx",
        "ABUSEIPDB_KEY": "your-abuseipdb-key",
        "GREYNOISE_API_KEY": "your-greynoise-key",
        "SHODAN_KEY": "your-shodan-key"
      }
    }
  }
}

⚠️ Important: Always use absolute paths. Fully quit Claude Desktop (Cmd+Q / Alt+F4) after changing the config — reloading is not enough.

Claude Code configuration

```bash

With environment variables (repeat -e for each key)

claude mcp add cve-mcp -e NVD_API_KEY=your_key -e VULNCHECK_TOKEN=your_token -- python -m cve_mcp.server

Or just run from the project directory — python-dotenv auto-loads .env on startup

Add your free NVD API key to .env

NVD_API_KEY=your-key-here

NVD API key — free at https://nvd.nist.gov/developers/request-an-api-key

GreyNoise — uses /v3/ip/{ip} endpoint (NOT the deprecated /v3/community)

GREYNOISE_API_KEY= # https://viz.greynoise.io/signup

API key protection

• Keys loaded from environment variables only — never hardcoded
• .env is gitignored
• Keys never logged, cached, or included in audit entries

https://nvd.nist.gov/developers/request-an-api-key

```

The server queues excess requests automatically, but with a key you get 10× throughput.

The server uses /v3/ip/{ip} — NOT the deprecated /v3/community endpoint

```

Known API limitations

• NVD returns max 2,000 results per query
• EPSS scores for brand-new CVEs (< 24 hours old) may not exist yet
• CISA KEV updates on US business days only
• GreyNoise community tier: 50 queries/week
• VirusTotal free tier: 4 requests/minute
• CIRCL PDNS requires manual registration and approval
• Ransomwhere has a 90-day embargo on new addresses

Using uv (faster alternative)

git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server
uv venv
source .venv/bin/activate  # or .venv\Scripts\activate on Windows
uv pip install -e .
cp .env.example .env

🔧 Troubleshooting