Cisa Cybersecurity MCP server

online · 100% uptime

by cyanheads·io.github.cyanheads/cisa-cybersecurity-mcp-server·v0.4.0·1 stars

No reviews yet

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

A93/100grade A

Write a review Run it

What users say

No reviews yet

Be the first

Safety scan

A93/100

not scanned yet

Adoption

Growing

1 stars582 downloads/wk

Reviews

Write one

Nobody has reviewed Cisa Cybersecurity yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Cisa Cybersecurity tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Not scanned yet. New listings are scanned within a day or two of arriving.

How Cisa Cybersecurity compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 93/100; higher than 95% of 48,243 servers
Uptime: 100%; of our recent checks; the typical remote server answers 100%
Response time: 556 ms; faster than 29% of 30,027 servers
GitHub stars: 1; more than 65% of 28,706 servers
Downloads a week: 582; more than 90% of 12,306 servers with a package

Release history: 7 versions in the registry since 2026-09-20, latest 2026-11-01, typically one every 6 days.

Install Cisa Cybersecurity in Claude Code, Cursor or VS Code

claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp

Add to Cursor

What the publisher says

From the Cisa Cybersecurity repository's README, as published. We do not edit it. Read it on GitHub

@cyanheads/cisa-cybersecurity-mcp-server CISA Known Exploited Vulnerabilities with BOD 26-04 deadlines, SSVC prioritization, and the full ICS advisory corpus (CSAF) via MCP. Keyless. STDIO & Streamable HTTP. 7 Tools • 2 Resources

Public Hosted Server: https://cisa-cybersecurity.caseyjhand.com/mcp

Overview

CISA's open vulnerability outputs, made queryable: the Known Exploited Vulnerabilities catalog and the federal remediation deadlines it carries, the SSVC decision points CISA publishes per CVE in Vulnrichment, the full CSAF corpus of industrial control system advisories back to 2010, and CISA's current publication feeds. Check a scan's worth of CVE IDs against KEV in one call, find what is overdue for a vendor, work out what BOD 26-04 implies for an asset you own, and search or read ICS advisories by vendor, product, CVE, CWE, CVSS, sector, or whether they cover an exploited vulnerability. Every source is keyless and read-only. Runs as a stdio process, a local Streamable HTTP server, or the public hosted endpoint above.

Tools

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Cisa Cybersecurity: common questions

Is Cisa Cybersecurity MCP server safe?: Yes, by our scan: it is graded A (93/100). Read the Cisa Cybersecurity safety report
How do I install Cisa Cybersecurity?: It runs remotely at cisa-cybersecurity.caseyjhand.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Cisa Cybersecurity need an API key?: No secret keys are declared. It reads 23 settings from the environment.
Is Cisa Cybersecurity maintained?: The last commit was 22 days ago (2026-10-14). The latest release is v0.4.0.
Is Cisa Cybersecurity up?: 100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Cisa Cybersecurity compare with other MCP servers?: safety score 93/100 (higher than 95% of 48,243 servers); uptime 100% (of our recent checks; the typical remote server answers 100%); response time 556 ms (faster than 29% of 30,027 servers). Full comparison.

Run it through the gateway

With the gateway added, ask your agent for it by name:

agent prompt

call io.github.cyanheads/cisa-cybersecurity-mcp-server → <tool>

Free per call. Metered, capped by your key, logged for reliability.

Add the gateway (gw.mcp.market)

Rating: —
Safety grade: A · 93/100
Stars: 1
Downloads/wk: 582
Price: Free
Licence: Apache-2.0
Transport: Remote · mixed
Uptime: 100% · 28/28 checks
Version: 0.4.0
Category: Everything else
Last release: 2026-10-14

Credentials it needs

CISA_CLAMP_OVERSIZED_INPUTSReturn bounded results and explicit unprocessed CVE IDs for oversized reads. Set false to reject requests above each tool's workload cap.
MCP_LOG_LEVELSets the minimum log level for output (e.g., 'debug', 'info', 'warn').
CISA_KEV_REFRESH_CRONCron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.
CISA_CSAF_MIRROR_PATHFilesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.
CISA_CSAF_MIRROR_AUTO_INITSeed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.
CISA_CSAF_REFRESH_CRONCron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.
CISA_VULNRICHMENT_CACHE_TTL_SECONDSSeconds a fetched SSVC record stays cached. Negative results use one sixth of this value.
CISA_FEED_CACHE_TTL_SECONDSSeconds a parsed RSS feed window stays cached.
CISA_HTTP_TIMEOUT_MSPer-request timeout in milliseconds for every upstream fetch.
CISA_CLAMP_OVERSIZED_INPUTSReturn bounded results and explicit unprocessed CVE IDs for oversized reads. Set false to reject requests above each tool's workload cap.
MCP_TRANSPORT_TYPESelects the HTTP transport.
MCP_HTTP_HOSTThe hostname for the HTTP server.
MCP_HTTP_PORTThe port to run the HTTP server on.
MCP_HTTP_ENDPOINT_PATHThe endpoint path for the MCP server.
MCP_AUTH_MODEAuthentication mode to use: 'none', 'jwt', or 'oauth'.
MCP_LOG_LEVELSets the minimum log level for output (e.g., 'debug', 'info', 'warn').
CISA_KEV_REFRESH_CRONCron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.
CISA_CSAF_MIRROR_PATHFilesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.
CISA_CSAF_MIRROR_AUTO_INITSeed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.
CISA_CSAF_REFRESH_CRONCron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.
CISA_VULNRICHMENT_CACHE_TTL_SECONDSSeconds a fetched SSVC record stays cached. Negative results use one sixth of this value.
CISA_FEED_CACHE_TTL_SECONDSSeconds a parsed RSS feed window stays cached.
CISA_HTTP_TIMEOUT_MSPer-request timeout in milliseconds for every upstream fetch.

Endpoint

https://cisa-cybersecurity.caseyjhand.com/mcp

streamable-http

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/cyanheads-cisa-cybersecurity-mcp-server.svg)](https://mcp.market/server/cyanheads-cisa-cybersecurity-mcp-server)

How the badge works