KBrain Concepts
NVD and CISA KEV data via MCP, without self-hosting
Access NVD CVE records and the CISA KEV catalog through MCP, plus EPSS scores, from a hosted brain refreshed daily. No NVD key, no server, no self-hosting.
Add the CVE brain to your AI assistant
NVD, the National Vulnerability Database, and the CISA Known Exploited Vulnerabilities catalog are both public, authoritative sources. The hard part is not access, it is turning them into something an AI assistant can query reliably at the moment you ask. KBrain does that: it ingests NVD, CISA KEV, and FIRST.org EPSS daily and exposes them over a single hosted MCP endpoint, so you never run a server or manage an API key.
The three sources, combined
- NVD: the primary CVE record, with description, CVSS score and vector, weakness (CWE), affected products, and references.
- CISA KEV: the authoritative catalog of vulnerabilities known to be exploited in the wild, with the date each was added.
- FIRST.org EPSS: a daily probability that a vulnerability will be exploited in the next 30 days.
KBrain joins all three onto each CVE, so a single lookup returns the record, its exploited status, and its exploitation probability together, rather than sending you to three sources.
Why doing this yourself is more work than it looks
- NVD has strict rate limits; a full backfill without an API key is impractically slow, and the key must be requested and kept working.
- CISA KEV and EPSS are separate feeds in different formats that you have to fetch and refresh on a schedule.
- You then need somewhere to store the joined data and an MCP server to expose it, kept online.
What KBrain handles for you
- Daily ingestion: a scheduled job pulls NVD changes incrementally and refreshes CISA KEV and EPSS in full.
- Storage and joins: the sources are combined so KEV and EPSS are available on every CVE without a second call.
- A hosted MCP endpoint: one URL, connected to Claude, ChatGPT, or any MCP client, with read-only tools.
- Freshness signals: every record carries a last-updated timestamp, and a status tool reports the last sync.
The data is public and free. The value is in the daily collection, the joins, and an endpoint that stays online, which is exactly the part most people never want to operate.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
Is NVD and CISA KEV data free to access?
Yes, both are public. The cost is operational: collecting the data, respecting NVD rate limits, refreshing the feeds daily, and hosting an endpoint. KBrain handles all of that so you consume it over MCP without running anything.
Does KBrain include EPSS as well?
Yes. EPSS scores from FIRST.org are refreshed daily and joined onto each CVE, alongside the NVD record and CISA KEV status.
Do I need an NVD API key?
Not as a user of the brain. KBrain uses a key on the ingestion side; you simply connect the hosted endpoint to your assistant.
How often is the data refreshed?
NVD is synced daily on an incremental basis, and CISA KEV and EPSS are refreshed in full daily. A status tool reports the last successful sync time.