Guide
How to look up CVEs in Claude with live NVD and CISA data
Give Claude live CVE data over MCP. Look up CVSS scores, CISA KEV exploited status, and EPSS probabilities from a hosted brain refreshed daily, instead of relying on training data.
Add the CVE brain to your AI assistant
Claude is a strong reasoner, but it cannot know a CVE that was published after its training cutoff, and it will not tell you when it is guessing. For vulnerability work that gap matters. The KBrain CVE brain connects to Claude over MCP and gives it a live source for CVE details, CISA KEV exploited status, and EPSS scores, all refreshed daily and hosted for you.
What you get once it is connected
- Full CVE detail on demand: description, CVSS score and vector, affected products, references, KEV status, and EPSS.
- Keyword and product search with severity and date filters.
- Recent CVEs for a rolling window, optionally filtered by minimum severity.
- A quick CISA KEV check that returns a clear exploited yes or no with the date added.
How to connect the CVE brain to Claude
- Add the CVE brain to your KBrain account.
- Add your KBrain MCP endpoint to Claude as a connector, following the standard MCP setup.
- Ask Claude a CVE question. It calls the brain, retrieves the current record, and answers from it with a last-updated timestamp.
For the exact steps, see the guide on connecting a knowledge base to Claude via MCP. The CVE tools appear automatically once the connector is added, alongside any other brains you use.
Why grounding Claude matters here
A general model asked about a fresh CVE tends to produce a confident answer that is stale or fabricated. In security that is a real risk, because the answer drives a patch decision. Grounding Claude in a live brain means the model reasons over current data rather than its memory: it still explains and prioritizes well, but the facts come from NVD, CISA, and FIRST.org.
Questions to try
- "Summarize CVE-2021-44228 and tell me if it is in CISA KEV."
- "Which critical CVEs shipped in the last 7 days?"
- "Compare the EPSS scores of these three CVEs and tell me which to patch first."
- "Find recent high-severity CVEs affecting Fortinet products."
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
Can Claude look up any CVE?
Once the CVE brain is connected, Claude can look up any CVE that has been ingested from NVD, which is the full published catalog, refreshed daily. Very recently published CVEs appear after the next daily sync.
Is there anything to install or host?
No. The CVE brain is hosted by KBrain and refreshed for you. You add the MCP connector to Claude once; there is no server to run and no NVD key to manage.
Does the CVE brain work alongside my other brains in Claude?
Yes. The CVE tools are exposed through the same KBrain connector as your other brains, so Claude can use them together in a single conversation.
How do I know the answer is current?
Every CVE answer includes a last-updated timestamp drawn from the daily sync, so you can confirm the data is fresh rather than recalled from training.