io.github.cyanheads/cisa-cybersecurity-mcp-server

Official7 toolsLive

by cyanheads · TypeScript

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

io.github.cyanheads/cisa-cybersecurity-mcp-server (MCP)

This MCP server provides CISA guidance focused on KEV, including deadlines from BOD 26-04, and prioritization using SSVC. It is also described as covering an ICS advisory corpus distributed in CSAF format. The server is keyless.

🛠️ Key Features

CISA KEV coverage
BOD 26-04 deadlines support
SSVC-based prioritization
ICS advisory corpus in CSAF format
Keyless operation

🚀 Use Cases

Track CISA KEV items against BOD 26-04 deadlines
Prioritize vulnerabilities or advisories using SSVC
Consume ICS advisory information via CSAF

⚡ Developer Benefits

Structured advisory data availability (CSAF)
Clear alignment with CISA KEV, BOD 26-04 deadlines, and SSVC prioritization
No key management required (keyless)

⚠️ Limitations

No additional tools, counts, or interfaces are specified in the provided data.

Topics

mcpmcp-servermodel-context-protocolai-agentsai-toolstypescriptcyanheadscisakevknown-exploited-vulnerabilitiesssvccsafics-securityvulnerability-management

Captured live from the server via tools/list.

cisa_list_reference

Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.

Parameters1

topic

string

required

Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds).

Raw schema

{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "enum": [
        "directives",
        "kev_fields",
        "ssvc_values",
        "sectors",
        "advisory_id_formats",
        "severity_bands",
        "sources"
      ],
      "description": "Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds)."
    }
  },
  "required": [
    "topic"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_check_cve_status

Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.

Parameters2

cveIds	array	required	CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail "summary".
detail	string	optional	full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both.

Raw schema

{
  "type": "object",
  "properties": {
    "cveIds": {
      "minItems": 1,
      "maxItems": 200,
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
      },
      "description": "CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail \"summary\"."
    },
    "detail": {
      "default": "full",
      "description": "full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both.",
      "type": "string",
      "enum": [
        "full",
        "summary"
      ]
    }
  },
  "required": [
    "cveIds"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_search_kev

Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.

Parameters17

vendorProject	string	optional	Case-insensitive substring of CISA's own vendor label.
product	string	optional	Case-insensitive substring of CISA's own product label.
nameContains	string	optional	Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback.
cwe	string	optional	Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match.
cveIdPrefix	string	optional	Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized.
dateAddedFrom	string	optional	Earliest date added, inclusive, YYYY-MM-DD.
dateAddedTo	string	optional	Latest date added, inclusive, YYYY-MM-DD.
dueBefore	string	optional	Latest due date, inclusive, YYYY-MM-DD.
dueAfter	string	optional	Earliest due date, inclusive, YYYY-MM-DD.
overdue	boolean	optional	True selects entries whose due date is strictly before the echoed asOf date.
ransomware	boolean	optional	True selects entries CISA has linked to ransomware campaigns.
forensicTriage	boolean	optional	True selects the BOD 26-04 three-day forensic-triage tier.
directive	string	optional	Which directive the entry cites. "none" selects the entries citing neither.
sortBy	string	optional	Field to sort by.
order	string	optional	Sort direction.
limit	integer	optional	Maximum entries per page.
cursor	string	optional	Opaque pagination cursor from a previous call. Omit for the first page.

Raw schema

{
  "type": "object",
  "properties": {
    "vendorProject": {
      "description": "Case-insensitive substring of CISA's own vendor label.",
      "type": "string",
      "minLength": 2
    },
    "product": {
      "description": "Case-insensitive substring of CISA's own product label.",
      "type": "string",
      "minLength": 2
    },
    "nameContains": {
      "description": "Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback.",
      "type": "string",
      "minLength": 2
    },
    "cwe": {
      "description": "Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match.",
      "type": "string",
      "pattern": "^CWE-[0-9]+$"
    },
    "cveIdPrefix": {
      "description": "Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized.",
      "type": "string",
      "pattern": "^CVE-[0-9]{4}$"
    },
    "dateAddedFrom": {
      "description": "Earliest date added, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "dateAddedTo": {
      "description": "Latest date added, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "dueBefore": {
      "description": "Latest due date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "dueAfter": {
      "description": "Earliest due date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "overdue": {
      "description": "True selects entries whose due date is strictly before the echoed asOf date.",
      "type": "boolean"
    },
    "ransomware": {
      "description": "True selects entries CISA has linked to ransomware campaigns.",
      "type": "boolean"
    },
    "forensicTriage": {
      "description": "True selects the BOD 26-04 three-day forensic-triage tier.",
      "type": "boolean"
    },
    "directive": {
      "description": "Which directive the entry cites. \"none\" selects the entries citing neither.",
      "type": "string",
      "enum": [
        "BOD 26-04",
        "BOD 22-01",
        "none"
      ]
    },
    "sortBy": {
      "default": "dateAdded",
      "description": "Field to sort by.",
      "type": "string",
      "enum": [
        "dueDate",
        "dateAdded"
      ]
    },
    "order": {
      "default": "desc",
      "description": "Sort direction.",
      "type": "string",
      "enum": [
        "asc",
        "desc"
      ]
    },
    "limit": {
      "default": 25,
      "description": "Maximum entries per page.",
      "type": "integer",
      "minimum": 1,
      "maximum": 100
    },
    "cursor": {
      "description": "Opaque pagination cursor from a previous call. Omit for the first page.",
      "type": "string"
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_get_ssvc

Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.

Parameters2

cveIds	array	required	CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check.
assetExposure	string	optional	Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. "unknown" returns both arms so the spread is visible without guessing.

Raw schema

{
  "type": "object",
  "properties": {
    "cveIds": {
      "minItems": 1,
      "maxItems": 50,
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
      },
      "description": "CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check."
    },
    "assetExposure": {
      "default": "unknown",
      "description": "Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. \"unknown\" returns both arms so the spread is visible without guessing.",
      "type": "string",
      "enum": [
        "publicly_exposed",
        "not_publicly_exposed",
        "unknown"
      ]
    }
  },
  "required": [
    "cveIds"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_search_ics_advisories

Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.

Parameters20

q	string	optional	Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number.
vendor	string	optional	Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact.
product	string	optional	Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters.
cve	string	optional	Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized.
cwe	string	optional	Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children.
inKev	boolean	optional	true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result.
cvssMin	number	optional	Minimum value of the advisory's maximum CVSS base score, inclusive.
cvssMax	number	optional	Maximum value of the advisory's maximum CVSS base score, inclusive.
severity	string	optional	Severity band of the advisory's maximum CVSS score.
sector	string	optional	Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors.
series	string	optional	Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus.
publisher	string	optional	coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus.
publishedFrom	string	optional	Earliest initial release date, inclusive, YYYY-MM-DD.
publishedTo	string	optional	Latest initial release date, inclusive, YYYY-MM-DD.
revisedFrom	string	optional	Earliest current release date, inclusive, YYYY-MM-DD.
revisedTo	string	optional	Latest current release date, inclusive, YYYY-MM-DD.
sortBy	string	optional	Field to sort by. relevance requires q and ranks by FTS5 bm25.
order	string	optional	Sort direction. Under relevance, desc means most relevant first.
limit	integer	optional	Maximum advisories per page.
cursor	string	optional	Opaque pagination cursor from a previous call. Omit for the first page.

Raw schema

{
  "type": "object",
  "properties": {
    "q": {
      "description": "Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number.",
      "type": "string",
      "minLength": 2
    },
    "vendor": {
      "description": "Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact.",
      "type": "string",
      "minLength": 2
    },
    "product": {
      "description": "Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters.",
      "type": "string",
      "minLength": 2
    },
    "cve": {
      "description": "Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized.",
      "type": "string",
      "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
    },
    "cwe": {
      "description": "Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children.",
      "type": "string",
      "pattern": "^CWE-[0-9]+$"
    },
    "inKev": {
      "description": "true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result.",
      "type": "boolean"
    },
    "cvssMin": {
      "description": "Minimum value of the advisory's maximum CVSS base score, inclusive.",
      "type": "number",
      "minimum": 0,
      "maximum": 10
    },
    "cvssMax": {
      "description": "Maximum value of the advisory's maximum CVSS base score, inclusive.",
      "type": "number",
      "minimum": 0,
      "maximum": 10
    },
    "severity": {
      "description": "Severity band of the advisory's maximum CVSS score.",
      "type": "string",
      "enum": [
        "NONE",
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ]
    },
    "sector": {
      "description": "Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors.",
      "type": "string",
      "enum": [
        "Chemical",
        "Commercial Facilities",
        "Communications",
        "Critical Manufacturing",
        "Dams",
        "Defense Industrial Base",
        "Emergency Services",
        "Energy",
        "Financial Services",
        "Food and Agriculture",
        "Government Facilities",
        "Healthcare and Public Health",
        "Information Technology",
        "Nuclear Reactors, Materials, and Waste",
        "Transportation Systems",
        "Water and Wastewater Systems",
        "Multiple"
      ]
    },
    "series": {
      "description": "Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus.",
      "type": "string",
      "enum": [
        "ICSA",
        "ICSMA"
      ]
    },
    "publisher": {
      "description": "coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus.",
      "type": "string",
      "enum": [
        "coordinator",
        "other"
      ]
    },
    "publishedFrom": {
      "description": "Earliest initial release date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "publishedTo": {
      "description": "Latest initial release date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "revisedFrom": {
      "description": "Earliest current release date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "revisedTo": {
      "description": "Latest current release date, inclusive, YYYY-MM-DD.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "sortBy": {
      "default": "revised",
      "description": "Field to sort by. relevance requires q and ranks by FTS5 bm25.",
      "type": "string",
      "enum": [
        "relevance",
        "published",
        "revised",
        "maxCvss"
      ]
    },
    "order": {
      "default": "desc",
      "description": "Sort direction. Under relevance, desc means most relevant first.",
      "type": "string",
      "enum": [
        "asc",
        "desc"
      ]
    },
    "limit": {
      "default": 20,
      "description": "Maximum advisories per page.",
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    },
    "cursor": {
      "description": "Opaque pagination cursor from a previous call. Omit for the first page.",
      "type": "string"
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_get_advisory

Read one CISA industrial control system advisory in full: affected products flattened from the CSAF product tree into vendor, product, and version ranges; per-CVE CVSS score, vector, and CWE; remediations with their category and vendor instructions; critical-infrastructure sectors; and the revision history. Large advisories return a section outline instead of the whole document, listing each section's size and the CVE IDs the vulnerabilities section holds — re-call with the sections you need, or with cves to read only those vulnerability entries. Republished vendor advisories carry the originating vendor's text; every response reports the source URL and attribution. Find advisory IDs with cisa_search_ics_advisories.

Parameters3

advisoryId	string	required	Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized.
sections	array	optional	Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget.
cves	array	optional	Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include "vulnerabilities".

Raw schema

{
  "type": "object",
  "properties": {
    "advisoryId": {
      "type": "string",
      "pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
      "description": "Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized."
    },
    "sections": {
      "description": "Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget.",
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "advisory",
          "summary",
          "products",
          "vulnerabilities",
          "revisionHistory",
          "references",
          "acknowledgments"
        ],
        "description": "One section name, as the outline reports it."
      }
    },
    "cves": {
      "description": "Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include \"vulnerabilities\".",
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier the advisory covers, e.g. CVE-2023-3935. Case and surrounding whitespace are normalized."
      }
    }
  },
  "required": [
    "advisoryId"
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

cisa_get_alerts

List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.

Parameters3

feed	string	optional	Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks).
limit	integer	optional	Maximum items to return. The 30 ceiling is the upstream window, not a server choice.
since	string	optional	Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it.

Raw schema

{
  "type": "object",
  "properties": {
    "feed": {
      "default": "advisories",
      "description": "Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks).",
      "type": "string",
      "enum": [
        "advisories",
        "alerts",
        "ics"
      ]
    },
    "limit": {
      "default": 30,
      "description": "Maximum items to return. The 30 ceiling is the upstream window, not a server choice.",
      "type": "integer",
      "minimum": 1,
      "maximum": 30
    },
    "since": {
      "description": "Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it.",
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false
}

README.md22 KBView on GitHub

@cyanheads/cisa-cybersecurity-mcp-server

CISA Known Exploited Vulnerabilities with BOD 26-04 deadlines, SSVC prioritization, and the full ICS advisory corpus (CSAF) via MCP. Keyless. STDIO & Streamable HTTP.

7 Tools • 2 Resources

Version MCP SDK TypeScript Bun

Public Hosted Server: https://cisa-cybersecurity.caseyjhand.com/mcp

Overview

CISA's open vulnerability data: the Known Exploited Vulnerabilities catalog and its federal remediation deadlines, the SSVC decision points CISA publishes per CVE in Vulnrichment, the CSAF corpus of industrial control system advisories back to 2010, and CISA's publication feeds. Check a scan's worth of CVE IDs against KEV in one call, find what is overdue for a vendor, work out the BOD 26-04 timeline for an asset you own, and search or read ICS advisories. Every source is keyless. Runs as a stdio process, a local Streamable HTTP server, or the public hosted endpoint above.

Tools

Tool	Description
`cisa_list_reference`	Decode the input vocabulary (BOD 26-04 timelines, KEV fields, SSVC values, sectors, ID formats, severity bands) and report what data the server holds
`cisa_check_cve_status`	Check up to 200 CVE IDs against KEV in one call: deadlines, overdue status, ransomware and forensic-triage flags, cited directive
`cisa_search_kev`	Search KEV by vendor, product, CWE, date added, due date, overdue status, ransomware linkage, forensic-triage tier, or directive
`cisa_get_ssvc`	Fetch CISA's published SSVC decision points per CVE and compute the BOD 26-04 timeline for a stated asset exposure
`cisa_search_ics_advisories`	Search ICS advisories by vendor, product, CVE, CWE, KEV membership, CVSS, severity, sector, series, dates, or free text
`cisa_get_advisory`	Read one ICS advisory: affected product versions, per-CVE CVSS and CWE, remediations, sectors, revision history
`cisa_get_alerts`	List CISA's latest items from its advisory, alert, or ICS advisory feed

Resources

Resource	Description
`cisa://kev/{cveId}`	One KEV catalog entry by CVE ID
`cisa://advisory/{advisoryId}`	One ICS advisory, flattened from CSAF 2.0

Both resources are fully covered by the tools above, so a tool-only client loses nothing.

Capability reference

`cisa_list_reference` _tool

One required topic: directives, kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources; reads in-process state only, so it answers while other tools are failing
directives adds timelineTable (all 16 rows of BOD 26-04 Table 1, with remediationTimelineDays and forensicTriageRequired), definitions, and supersedes; sources reports the KEV catalogVersion, the advisory index's ready / documentCount / syncStatus, the SSVC cache TTL, and the cached feed windows

`cisa_check_cve_status` _tool

Up to 200 cveIds per call, answered from the cached KEV snapshot with no upstream request; a CVE outside KEV comes back inKev: false, not as an error
Per CVE: dateAdded, dueDate, daysUntilDue, overdue, requiredAction, knownRansomwareCampaignUse, forensicTriage, cwes[], every URL in the entry's notes as references[] typed by kind, and a three-state directive (BOD 26-04, BOD 22-01, or null); the response echoes the catalog snapshot and the asOf date the deadlines were computed against
detail: "summary" trims each in-KEV record to the triage fields (dates, deadline status, directive, vendor and product labels, ransomware and forensic-triage flags), which keeps a full 200-CVE batch compact; full is the default

`cisa_search_kev` _tool

Filters AND together over the whole snapshot: vendorProject and product (CISA's own labels, not CPE names), nameContains, cwe, cveIdPrefix, dateAddedFrom / dateAddedTo, dueBefore / dueAfter, overdue, ransomware, forensicTriage, directive (BOD 26-04 / BOD 22-01 / none); up to 100 per page (default 25) with an opaque cursor. cwe and cveIdPrefix normalize case and surrounding whitespace
Sorts by dateAdded (default) or dueDate and reports totalCount and appliedFilters; a zero-hit result names the filter that matches nothing on its own and what dropping it restores, or the filters whose removal restores results and how many
nameContains matches the letters a-z and the digits 0-9 after folding case and accents and spelling letters such as ß, æ, and ø as ss, ae, and o; any other letter or digit, such as a word in another script, is dropped, and the notice names it and the tokens actually searched
Typed errors: catalog_unavailable (retryable), invalid_date_range, empty_search_text

`cisa_get_ssvc` _tool

Up to 50 cveIds per call, each a live Vulnrichment lookup, plus assetExposure: publicly_exposed, not_publicly_exposed, or unknown (default, returns both arms)
Per CVE: found, exploitation, automatable, technicalImpact, cvss and cwes where CISA published them, and bod2604.timelines[] (tableRow, remediationTimelineDays, forensicTriageRequired); a KEV entry adds kevAssigned, plus assignmentAgrees when an exposure was stated
A CVE with no enrichment is found: false with guidance; enrichment_source_unavailable (retryable) fires only when every fetch fails

`cisa_search_ics_advisories` _tool

Full-text q over titles, vendor names, and product names, plus vendor, product, cve, cwe, inKev, cvssMin / cvssMax, severity, sector, series (ICSA / ICSMA), publisher (coordinator / other), publishedFrom / publishedTo, revisedFrom / revisedTo; sorts by revised (default), published, maxCvss, or relevance (needs q); up to 50 per page (default 20) with an opaque cursor. cve and cwe normalize case and surrounding whitespace
Results carry advisoryId, up to 20 cves with cveCount, kevCves, maxCvss with severityDerived, sectors, url, csafUrl, and attribution; without inKev, an unloaded KEV snapshot leaves kevCves out and says so rather than failing
Reports totalCount and appliedFilters; a zero-hit result names the filter that matches nothing on its own and what dropping it restores, or the filters whose removal restores results and how many
vendor and product are case-insensitive substrings matched literally, non-ASCII capitals included, so a label copied from a result matches its own advisories
Typed errors: mirror_not_ready and catalog_unavailable (retryable), mirror_unavailable, invalid_cvss_range, invalid_date_range, relevance_sort_without_query, empty_search_text

`cisa_get_advisory` _tool

advisoryId (optional revision suffix; case, surrounding whitespace, and a trailing .json are normalized, and every ID comes back in its uppercase form), optional sections (advisory, summary, products, vulnerabilities, revisionHistory, references, acknowledgments), and optional cves to narrow vulnerabilities to named entries
Returns kind: "full", or kind: "outline" when a document read without sections exceeds the 24,000-byte budget: per-section byte sizes plus the CVE IDs in vulnerabilities, for a stateless re-call
An ID not in the index returns found: false with guidance, indexCheckpoint, and indexLastSyncedAt; the guidance says when the ID's own date is later than the last sync, so the advisory may be newer than the index
Typed errors: mirror_not_ready (retryable), mirror_unavailable, unknown_section, unknown_cve, cves_need_vulnerabilities_section

`cisa_get_alerts` _tool

feed: advisories (default), alerts, or ics; limit up to 30, the upstream window size; since (YYYY-MM-DD) filters within that window and cannot reach past it
Items carry title, link, pubDate, summary (HTML stripped, capped at 1,200 characters, flagged by summaryTruncated), and on ICS items an advisoryId for cisa_get_advisory; window reports itemCount, oldest, newest, and upstreamWindowSize. Typed error: feed_unavailable (retryable)

`cisa://kev/{cveId}` _resource

One KEV record as application/json, the same shape as a cisa_check_cve_status result under the default detail: "full"; a CVE not in KEV is a not-found error
Listing returns the 30 most recently added entries; cveId completes from the snapshot, up to 100 suggestions

`cisa://advisory/{advisoryId}` _resource

One flattened advisory as application/json, with the same 24,000-byte outline-on-overflow as cisa_get_advisory; the template takes no sections or cves, so follow an outline up with the tool
Listing returns the 30 most recently revised advisories; advisoryId completes from the index, up to 100 suggestions

Features

Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.

CISA-specific:

Four public sources, no account or key: the KEV JSON feed, Vulnrichment, the CSAF ICS advisory repository, and CISA's RSS feeds
None of them offers search, so every filter runs locally: KEV as an in-memory snapshot kept current by a conditional-GET poll, ICS advisories as a SQLite index with FTS5
Boot never waits on the advisory index; the KEV, SSVC, and alert tools serve from the first request while it seeds in the background
BOD 26-04 Table 1 ships as data, so a computed timeline is a table lookup over published decision points. It is not a compliance determination, and it is reported beside CISA's assigned KEV due date, never reconciled with it

Agent-friendly output:

Provenance on every response: the KEV catalog version and asOf date, the index checkpoint behind a search, and url, csafUrl, and attribution on every advisory
Discriminated outputs: a three-state directive, typed references[].kind, found / inKev booleans, severityDerived on a band upstream never published, and typed error reasons with recovery hints
Empty results and upstream gaps explain themselves: a zero-hit search names the filter responsible and the next call, and filters that hit a known gap (sector notes only from 2017, CVSS v2-only advisories, no KEV revision timestamps) say so in the response. The full list is under Known Limitations in the design doc

Getting started

Public Hosted Instance

A public instance is available at https://cisa-cybersecurity.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:

json

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "streamable-http",
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
    }
  }
}

Self-Hosted / Local

Add the following to your MCP client configuration file. No API key is required.

json

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "stdio",
      "command": "bunx",
      "args": ["@cyanheads/cisa-cybersecurity-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Or with npx (no Bun required):

json

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@cyanheads/cisa-cybersecurity-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Or with Docker:

json

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MCP_TRANSPORT_TYPE=stdio",
        "-v", "cisa-mirror:/usr/src/app/.mirror",
        "ghcr.io/cyanheads/cisa-cybersecurity-mcp-server:latest"
      ]
    }
  }
}

For Streamable HTTP, set the transport and start the server:

MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcp

Prerequisites

Bun v1.4.0 or higher (or Node.js v24+).
No credentials. Every upstream source is keyless and public.

Installation

Clone the repository:

git clone https://github.com/cyanheads/cisa-cybersecurity-mcp-server.git

Navigate into the directory:

cd cisa-cybersecurity-mcp-server

Install dependencies:

bun install

Configuration

Every variable is optional; the server runs correctly with none of them set.

Variable	Description	Default
`CISA_KEV_REFRESH_CRON`	Cron for the KEV conditional-refresh poll, on every transport. `off` disables it; an invalid expression fails startup.	`/30 * * *`
`CISA_CSAF_MIRROR_PATH`	Filesystem path to the ICS advisory SQLite index.	`<user cache dir>/cisa-cybersecurity-mcp-server/csaf.sqlite3`
`CISA_CSAF_MIRROR_AUTO_INIT`	Seed the index in the background when it has never synced, and re-ingest one an older version built.	`true`
`CISA_CSAF_REFRESH_CRON`	Cron for the incremental advisory refresh, on every transport; it also runs once at startup. `off` disables both; an invalid expression fails startup.	`17 /6 * *`
`CISA_VULNRICHMENT_CACHE_TTL_SECONDS`	TTL for a cached SSVC record; negative results use one sixth of it.	`21600`
`CISA_FEED_CACHE_TTL_SECONDS`	TTL for a parsed RSS feed window.	`900`
`CISA_HTTP_TIMEOUT_MS`	Per-request timeout for every upstream fetch, in ms.	`30000`
`MCP_TRANSPORT_TYPE`	Transport: `stdio` or `http`.	`stdio`
`MCP_HTTP_PORT`	HTTP server port.	`3010`
`MCP_SESSION_MODE`	HTTP session mode: `stateless`, `stateful`, or `auto`.	`stateless`
`MCP_AUTH_MODE`	Authentication: `none`, `jwt`, or `oauth`.	`none`
`MCP_LOG_LEVEL`	Log level (`debug`, `info`, `warning`, `error`, etc.).	`info`
`LOGS_DIR`	Directory for log files (Node.js only).	`<project-root>/logs`
`STORAGE_PROVIDER_TYPE`	Storage backend for the SSVC cache: `in-memory`, `filesystem`, or `supabase`.	`in-memory`
`OTEL_ENABLED`	Enable OpenTelemetry.	`false`

See .env.example for the full list of optional overrides.

Running the server

Local development

Build and run:

# One-time build
bun run rebuild

# Run the built server
bun run start:stdio
# or
bun run start:http

Run checks and tests:

bun run devcheck   # Lint, format, typecheck, security
bun run test       # Vitest test suite
bun run lint:mcp   # Validate MCP definitions against spec

ICS advisory index

The two ICS tools and the advisory resource read a local SQLite index of the CSAF corpus at CISA_CSAF_MIRROR_PATH. Unset, it lives in your user cache directory — ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows — under cisa-cybersecurity-mcp-server/csaf.sqlite3, whatever directory the client starts the server from. On first run the server builds it in the background from one repository archive; until it is ready those surfaces return a retryable mirror_not_ready, and cisa_list_reference with topic sources shows progress. An index built by an older version re-ingests on the next start and keeps serving its current rows meanwhile. The .mcpb bundle needs nothing beyond that background seed. If the path cannot be opened (not writable, read-only, a missing directory, a file that is not a SQLite database), the ICS surfaces fail with a non-retryable mirror_unavailable, sources says why, and every other tool keeps working.

On every transport, the server refreshes the index once at startup and then on CISA_CSAF_REFRESH_CRON, and polls KEV on CISA_KEV_REFRESH_CRON. Server processes that share one index — every stdio session uses the default path — take a lease before seeding or refreshing it, so only one syncs at a time and the rest keep serving reads. For containers, CI, or seeding out of band (CISA_CSAF_MIRROR_AUTO_INIT=false, and CISA_CSAF_REFRESH_CRON=off to leave refreshes to you), run the scripts directly; they take the same lease:

bun run mirror:init      # full build, idempotent, safe to re-run after an interrupt
bun run mirror:refresh   # incremental: fetches only documents whose revision date moved
bun run mirror:verify    # readiness, sync status, checkpoint, count, content version, SQLite integrity; non-zero on failure

Docker

docker build -t cisa-cybersecurity-mcp-server .
docker run --rm -p 3010:3010 -v cisa-mirror:/usr/src/app/.mirror cisa-cybersecurity-mcp-server

The Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/cisa-cybersecurity-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them. The image sets CISA_CSAF_MIRROR_PATH=/usr/src/app/.mirror/csaf.sqlite3; mount a volume over /usr/src/app/.mirror so the advisory index survives a container recreation; the image ships the mirror:* scripts for docker exec <container> bun run mirror:refresh.

Project structure

Directory	Purpose
`src/index.ts`	`createApp()` entry point: wires the four services, schedules the refresh jobs, registers the surface.
`src/config`	Server-specific environment variable parsing and validation with Zod.
`src/mcp-server/tools`	Tool definitions (`*.tool.ts`).
`src/mcp-server/resources`	Resource definitions (`*.resource.ts`).
`src/mcp-server/schemas`	Output schemas and renderers shared by the KEV and advisory tools and resources.
`src/reference`	Static reference data: BOD 26-04 Table 1, canonical sector names, CVSS bands.
`src/services/kev-catalog`	KEV JSON feed: snapshot, derived indexes, conditional refresh.
`src/services/vulnrichment`	Per-CVE SSVC enrichment fetch with a TTL cache.
`src/services/csaf-mirror`	The ICS advisory index: schema, ingest, normalization, queries.
`src/services/cisa-feeds`	The three RSS feeds, parsed and cached on a TTL.
`scripts/`	Build, checks, and the `mirror:*` commands.
`tests/`	Unit, integration, fuzz, and smoke tests mirroring `src/`.

Development guide

See CLAUDE.md/AGENTS.md for development guidelines and architectural rules, and docs/design.md for the as-built specification. The short version:

Handlers throw, framework catches — no try/catch in tool logic
Use ctx.log for request-scoped logging, ctx.state for tenant-scoped storage
Register new tools and resources via the barrels in src/mcp-server/*/definitions/index.ts
Wrap external sources: validate raw → normalize to a domain type → return the output schema; never fabricate a field the upstream omitted

Contributing

Issues are welcome. Run checks and tests before submitting:

bun run devcheck
bun run test

License

Apache-2.0 — see LICENSE for details.

The license covers this code, not the data it serves. KEV entries are US Government work in the public domain and Vulnrichment is CC0-1.0, but the CSAF repository declares no license and many advisories republish vendor text, so check reuse rights at each advisory's url before redistributing it. This project is not affiliated with or endorsed by CISA or the Department of Homeland Security.

Install

Tools (7)

cisa_list_referencecisa_check_cve_statuscisa_search_kevcisa_get_ssvccisa_search_ics_advisoriescisa_get_advisorycisa_get_alerts

Configuration

Environment variables

MCP_LOG_LEVELdefault info

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

CISA_KEV_REFRESH_CRONdefault */30 * * * *

Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.

CISA_CSAF_MIRROR_PATH

Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.

CISA_CSAF_MIRROR_AUTO_INITdefault true

Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.

CISA_CSAF_REFRESH_CRONdefault 17 */6 * * *

Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.

CISA_VULNRICHMENT_CACHE_TTL_SECONDSdefault 21600

Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.

CISA_FEED_CACHE_TTL_SECONDSdefault 900

Seconds a parsed RSS feed window stays cached.

CISA_HTTP_TIMEOUT_MSdefault 30000

Per-request timeout in milliseconds for every upstream fetch.

MCP_TRANSPORT_TYPEdefault http

Selects the HTTP transport.

MCP_HTTP_HOSTdefault 127.0.0.1

The hostname for the HTTP server.

MCP_HTTP_PORTdefault 3010

The port to run the HTTP server on.

MCP_HTTP_ENDPOINT_PATHdefault /mcp

The endpoint path for the MCP server.

MCP_AUTH_MODEdefault none

Authentication mode to use: 'none', 'jwt', or 'oauth'.

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/cisa-cybersecurity-mcp-server@0.3.1"
      ],
      "env": {
        "MCP_LOG_LEVEL": "info",
        "CISA_KEV_REFRESH_CRON": "*/30 * * * *",
        "CISA_CSAF_MIRROR_PATH": "<YOUR_CISA_CSAF_MIRROR_PATH>",
        "CISA_CSAF_MIRROR_AUTO_INIT": "true",
        "CISA_CSAF_REFRESH_CRON": "17 */6 * * *",
        "CISA_VULNRICHMENT_CACHE_TTL_SECONDS": "21600",
        "CISA_FEED_CACHE_TTL_SECONDS": "900",
        "CISA_HTTP_TIMEOUT_MS": "30000"
      }
    }
  }
}

io.github.cyanheads/cisa-cybersecurity-mcp-server (MCP)

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

cisa_list_reference

cisa_check_cve_status

cisa_search_kev

cisa_get_ssvc

cisa_search_ics_advisories

cisa_get_advisory

cisa_get_alerts

@cyanheads/cisa-cybersecurity-mcp-server

Overview

Tools

Resources

Capability reference

cisa_list_reference tool

cisa_check_cve_status tool

cisa_search_kev tool

cisa_get_ssvc tool

cisa_search_ics_advisories tool

cisa_get_advisory tool

cisa_get_alerts tool

cisa://kev/{cveId} resource

cisa://advisory/{advisoryId} resource

Features

Getting started

Public Hosted Instance

Self-Hosted / Local

Prerequisites

Installation

Configuration

Running the server

Local development

ICS advisory index

Docker

Project structure

Development guide

Contributing

License

Install

Configuration

Related servers

`cisa_list_reference` _tool

`cisa_check_cve_status` _tool

`cisa_search_kev` _tool

`cisa_get_ssvc` _tool

`cisa_search_ics_advisories` _tool

`cisa_get_advisory` _tool

`cisa_get_alerts` _tool

`cisa://kev/{cveId}` _resource

`cisa://advisory/{advisoryId}` _resource