mcp-cve-intelligence -lite

The MCP CVE Intelligence Server Lite provides a lightweight, self-contained MCP server that aggregates vulnerability data from multiple sources (NVD, MITRE, GitHub Security Advisories) and exposes it through MCP-compatible tools. It includes capabilities for CVE discovery, detailed vulnerability intelligence, trending analysis, environmental risk scoring (EPSS), and professional reporting. Clients can interact with the server using MCP-compatible tooling (CLI, VS Code config, or other MCP clients) to search CVEs, fetch detailed CVE data with exploits and references, obtain trending vulnerabilities, compute EPSS scores for given contexts, and generate security reports in multiple formats. The server is designed to be starter-friendly and optimized for security workflows, with a focus on essential CVE intelligence features in its lite edition.

Prerequisites:

• Node.js 20.0.0 or higher
• npm comes with Node.js

Quick Start:

# Clone the repository (or install via npm if published as a package)
# If starting from source:
# git clone https://github.com/gnlds/mcp-cve-intelligence-server-lite.git
# cd mcp-cve-intelligence-server-lite

# Install dependencies
npm install

# Build the project (if applicable for this lite package)
npm run build

# Start the server
npm start

Docker Deployment (optional):

# Pull and run the latest image
docker run -d \
  --name mcp-cve-server \
  -p 13001:3001 \
  -e MCP_TRANSPORT_TYPE=http \
  -e MCP_HTTP_PORT=3001 \
  -e MCP_HTTP_HOST=0.0.0.0 \
  proug/mcp-cve-intelligence-server-lite:latest

MCP Client setup (examples):

# Quick install from NPM
npx @proug/mcp-cve-intelligence-server-lite@latest --help

VS Code MCP client configuration example:

{
  "servers": {
    "cve-intelligence": {
      "type": "stdio",
      "command": "npx", 
      "args": ["-y", "@proug/mcp-cve-intelligence-server-lite@latest"]
    }
  }
}

Tips and notes:

• The Lite edition focuses on core CVE intelligence features; for full capabilities consider the standard edition if available.
• Typical environment variables to tune networking and health checks use MCP_TRANSPORT_TYPE, MCP_HTTP_PORT, and MCP_HTTP_HOST.
• Health endpoint (e.g., /health) can confirm availability; ensure network access if running behind a proxy or in a container.
• If using Docker, you can override ports and environment settings to integrate with your existing monitoring and alerting.
• Ensure you have data source access permissions and API rate limits respected by the sources (NVD, MITRE, GitHub Advisories) when running in production.