Guide
How to build an AI agent that monitors CVEs
Build an AI agent that checks for new and exploited CVEs on a schedule and reports them, using a hosted CVE brain over MCP. No self-hosted vulnerability feed required.
Add the CVE brain to your AI assistant
A CVE monitoring agent is simpler than it sounds. It is a scheduled task that asks a few questions of a live CVE source, filters the results to what you care about, and reports them somewhere your team will see. The part that is usually hard, keeping a fresh CVE data source online, is handled by the KBrain CVE brain, so the agent itself is small.
The anatomy of the agent
- A schedule: a daily or hourly trigger, from cron, a workflow runner, or your agent framework.
- A data source: the KBrain CVE brain over MCP, exposing recent CVEs, search, and CISA KEV status.
- A filter: the products, vendors, and severity thresholds that matter to you.
- A destination: a Slack channel, an email, a ticket, or a dashboard.
What the agent should ask
Each run, the agent makes a small number of tool calls against the CVE brain and assembles a digest.
- get_recent_cves(1, "HIGH"): high and critical CVEs published since the last run.
- search_cves for each product in your stack, filtered to recent dates and a minimum severity.
- get_kev_status for any CVE already on your radar, to catch newly confirmed exploitation.
- Optionally, flag anything with a high EPSS score even if it is not yet in CISA KEV.
Turning results into a useful report
Raw matches are noisy. A good agent ranks them the way a human would: CISA KEV entries first, then high-EPSS items, then remaining high-severity CVEs. Because the brain returns all three signals on each record, the agent can sort without extra lookups, and it can include the last-updated timestamp so readers know the digest is current.
Keep the agent read-only and idempotent. It only retrieves and reports; it does not change anything. Store the last run time so each digest covers exactly the new window.
Why a hosted brain makes this practical
- No data pipeline to run: the brain is refreshed daily, so the agent never manages NVD keys or feed parsing.
- One connector, many clients: the same endpoint works whether your agent is built on Claude, on ChatGPT, or on a custom MCP client.
- Freshness you can report: the last-updated timestamp goes straight into the digest.
- Portable logic: the agent is a thin layer of scheduling and filtering, easy to move or rebuild.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
What does a CVE monitoring agent actually do?
It runs on a schedule, queries a live CVE source for new, exploited, or product-specific vulnerabilities, ranks them by risk, and posts a digest to a channel, email, or ticketing system. The KBrain CVE brain provides the live data over MCP.
What framework do I need?
Any agent or automation that can call MCP tools on a schedule works. The brain is client-agnostic, so you can build on Claude, ChatGPT, or a custom MCP client, and use cron or a workflow runner for scheduling.
How do I avoid duplicate alerts?
Store the timestamp of the last run and query only the new window each time, for example recent CVEs since the previous run. Because the brain returns a last-updated field, the agent can also dedupe on record identity.
Can the agent prioritize, not just list?
Yes. Each record includes CISA KEV status, EPSS score, and CVSS severity, so the agent can rank results, KEV first, then high EPSS, then high CVSS, without additional lookups.