KBrain Concepts
CVE MCP server: query NVD, CISA KEV and EPSS over MCP
A CVE MCP server exposes vulnerability data to AI assistants as callable tools. KBrain hosts one for you, covering NVD, CISA KEV, and EPSS, with no self-hosting required.
Add the CVE brain to your AI assistant
An MCP server exposes a set of tools that an AI assistant can call while it answers. A CVE MCP server exposes tools for vulnerability data: look up a CVE, search by product, list recent ones, check exploited status. The idea is sound, but every existing CVE MCP server has the same catch: you have to run it yourself. KBrain removes that catch by hosting the server for you and refreshing the data daily.
What a CVE MCP server exposes
Rather than prose, an MCP server offers a machine-readable set of tools, each with a name, a description, and a typed input schema. For CVE data, the KBrain brain exposes five read-only tools:
- get_cve(cve_id): full detail for one CVE, including CVSS score and vector, CWE, affected products, references, CISA KEV status, and EPSS score.
- search_cves(query, severity?, date_from?, date_to?): keyword, product, or vendor search with optional filters.
- get_recent_cves(days, min_severity?): CVEs published in a recent window.
- get_kev_status(cve_id): a quick CISA KEV exploited check with the date added.
- cve_server_status(): data freshness, row counts, and last sync time.
The problem with self-hosted CVE MCP servers
The open-source CVE MCP servers all leave the operational burden with you. That is the whole reason most people never get past a local experiment.
- Clone a repository and keep it updated.
- Request and manage an NVD API key, and respect its rate limits during the initial backfill.
- Run a process and keep it online, or the tool silently stops working.
- Wire in CISA KEV and EPSS yourself if the server does not already include them.
The hosted alternative
KBrain ingests NVD, CISA KEV, and EPSS on a daily schedule, stores them, and exposes the five tools above through a single hosted MCP endpoint. You connect that endpoint to your assistant once. There is no repository, no key, and no process to keep alive, and the same connector also carries any other KBrain brains you use.
The differentiation is entirely in the hosting. The data is public; the work is collecting it, refreshing it, and keeping the endpoint online. KBrain does that so you do not.
Getting started
- Add the CVE brain to your KBrain account.
- Connect the KBrain MCP endpoint to Claude, ChatGPT, or any MCP client.
- Call the CVE tools by asking questions in plain language.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
What is a CVE MCP server?
It is an MCP server that exposes vulnerability data as callable tools, so an AI assistant can look up CVEs, search them, and check exploited status while it answers. KBrain hosts one covering NVD, CISA KEV, and EPSS.
How is this different from mcp-nvd or other open-source CVE servers?
Those projects require you to self-host: clone the repo, manage an NVD key, and keep a process online. KBrain hosts the server and refreshes the data daily, so there is nothing to run. It also combines NVD, CISA KEV, and EPSS in one place.
Which assistants can use it?
Any MCP-compatible client, including Claude and, through a generated OpenAPI spec, ChatGPT. The same endpoint works across all of them.
Are the tools read-only?
Yes. All five CVE tools are read-only retrieval over public vulnerability data. They never modify your account or data.