MCP.Market

Vuln Triage MCP server

by kimmawla·io.github.kimmawla/vuln-triage-mcp·v0.1.0
No reviews yet

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

A89/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A89/100

full report

Adoption
Growing

0 stars142 downloads/wk

Reviews

Write one

Nobody has reviewed Vuln Triage yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Vuln Triage tools (5)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_known_exploited

    Whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog, i.e. confirmed exploited in the wild, with the date added and CISA's required action.

  • find_vulns_for_package

    List known vulnerabilities (OSV.dev) affecting a package, or one version of it.

  • get_epss_score

    FIRST EPSS exploit-prediction score for one CVE: the probability (0-1) of exploitation activity in the next 30 days, and its percentile among all CVEs.

  • lookup_vulnerability

    Raw advisory details for one vulnerability from OSV.dev: summary, details, CVSS, CVE aliases, fixed versions, and references.

  • triage_vulnerability

    Prioritize one vulnerability: OSV advisory, CVSS base score, EPSS exploit probability, CISA KEV status, and a 0-100 priority score with bucket, confidence, and reasoning. Also reports whether a fixed version exists.

Public scan report

scanner v0.1.10 · 2026-10-25 · same rubric, same numbers if you re-run it

no findings
  • Code scan12 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 89/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Vuln Triage compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
89/100
higher than 83% of 4,460 AI and agents servers
Tools
5
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
142
more than 70% of 1,538 AI and agents servers with a package

What its tools let an agent do: 5 read

Install Vuln Triage in Claude Code, Cursor or VS Code

claude mcp add vuln-triage-mcp -- uvx vuln-triage-mcp
Add to Cursor

What the publisher says

From the Vuln Triage repository's README, as published. We do not edit it. Read it on GitHub

vuln-triage-mcp

<!-- mcp-name: io.github.kimmawla/vuln-triage-mcp -->

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

Why this exists

Two or three sentences. CVSS alone ranks by severity, not by likelihood of exploitation. This server adds exploit probability (EPSS) and known exploitation (KEV), and shows its reasoning. Example: a CVSS 9.8 nobody exploits ranks below a CVSS 8.8 that is being exploited in the wild.

Quick start

Claude Code

claude mcp add vuln-triage -- uvx vuln-triage-mcp

Claude Desktop / other clients

JSON config snippet using uvx. Requires: Python 3.12+, no API keys.

Try it

Three example prompts and what to expect:

  • "Which is most urgent: CVE-2021-44228, CVE-2023-4863, CVE-2019-10744?"
  • "Is lodash 4.17.15 vulnerable? What should I upgrade to?"
  • "Is CVE-XXXX actively exploited?"

Tools

How scoring works

  • Formula: CVSS (base) x 40 + EPSS x 35 + KEV +25; KEV-listed floors at 80
  • Buckets: see the table below
  • Missing data: component omitted, named in reasoning, lowers confidence
  • Link to docs/scoring-spec.md

unknown takes precedence over high, medium, and low; it never applies to a KEV-listed vulnerability.

Reliability and limits

  • Partial results: if EPSS or KEV fails, the result names the missing source
  • Truncation: truncated, foundcount vs returnedcount, ranking_note
  • Stale KEV cache: stale and catalogfetchedat
  • Timeouts and retry policy (one line)
  • Package queries return at most 50 advisories, sorted by severity

Security

sanitized, length-capped, returned under untrusted_text, and flagged to the model in the server instructions

  • Advisory text is untrusted third-party content (prompt injection vector):
  • Input validation on all IDs and ecosystems
  • No credentials required or stored; read-only calls to three public APIs
  • Reporting vulnerabilities in this project: SECURITY.md or email

Evaluation

Golden set: 17 entries (16 CVEs, 1 GHSA) with expected buckets, confidence, and ordering, recorded 10/21/2026. Result: 17/17 match on the recorded fixtures (uv run pytest tests/testgolden.py), and 17/17 against the live APIs on 10/21/2026 (uv run pytest -m live tests/testgolden.py). EPSS drifts daily, so the live run can diverge over time; re-record the fixtures with uv run python scripts/recordgoldenfixtures.py when the golden set or scoring spec changes.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Vuln Triage: common questions

Is Vuln Triage MCP server safe?
Yes, by our scan: it is graded A (89/100). Read the Vuln Triage safety report
How do I install Vuln Triage?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Vuln Triage need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Vuln Triage maintained?
The last commit was 14 days ago (2026-10-21). The latest release is v0.1.0.
What can I use instead of Vuln Triage?
Servers from other publishers that do the same job: Basic Memory MCP server, HOL Guard MCP server and Agent-Native Chat MCP server.
How does Vuln Triage compare with other AI and agents MCP servers?
safety score 89/100 (higher than 83% of 4,460 AI and agents servers); tools 5 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Vuln Triage

Same job from other publishers: the closest match first, then the best rated.

  • Basic Memory
    Local-first knowledge management with bi-directional LLM sync via Markdown files.
    B
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Agent-Native Chat
    Minimal chat-first app with durable threads, actions, and the app-agent loop
    A
  • Agent Recall
    Correction-first agent memory. Precision KPI tracks if agents heed warnings. 5 layers, local-only.
    A
  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C