Security Intel MCP

Official4 toolsLive

by selflabbs · JavaScript

Threat intel for AI agents: CVE lookups, package vulns (OSV), URL threats, IP reputation.

Captured live from the server via tools/list.

cve_lookup

Look up a CVE by ID. Returns a compact summary: description, CVSS score/severity, CISA KEV (known-exploited) status, affected products, dates, and top references. Use before approving dependencies, evaluating alerts, or assessing exposure.

Parameters1

cve_id

string

required

CVE identifier, e.g. CVE-2021-44228

Raw schema

{
  "type": "object",
  "properties": {
    "cve_id": {
      "type": "string",
      "description": "CVE identifier, e.g. CVE-2021-44228",
      "pattern": "^CVE-\\d{4}-\\d{4,}$"
    }
  },
  "required": [
    "cve_id"
  ]
}

package_vulnerabilities

List known vulnerabilities for a software package (optionally a specific version) using OSV.dev. Covers npm, PyPI, Go, Maven, crates.io, RubyGems, Packagist, NuGet and more. Returns vuln IDs, severity, summary, and fixed versions.

Parameters3

ecosystem	string	required	Package ecosystem: npm, PyPI, Go, Maven, crates.io, RubyGems, Packagist, NuGet, Hex, Pub, Debian, Alpine
name	string	required	Package name, e.g. lodash or org.apache.logging.log4j:log4j-core
version	string	optional	Exact version to check (optional; omit to list all known vulns)

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "description": "Package ecosystem: npm, PyPI, Go, Maven, crates.io, RubyGems, Packagist, NuGet, Hex, Pub, Debian, Alpine"
    },
    "name": {
      "type": "string",
      "description": "Package name, e.g. lodash or org.apache.logging.log4j:log4j-core"
    },
    "version": {
      "type": "string",
      "description": "Exact version to check (optional; omit to list all known vulns)"
    }
  },
  "required": [
    "ecosystem",
    "name"
  ]
}

url_check

Check whether a URL is a known malware/phishing distribution site via abuse.ch URLhaus. Returns threat status, malware family tags, and takedown state. Use before fetching or recommending unfamiliar URLs.

Parameters1

url

string

required

Full URL to check, including scheme

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Full URL to check, including scheme"
    }
  },
  "required": [
    "url"
  ]
}

ip_reputation

Get abuse reputation for an IPv4/IPv6 address via AbuseIPDB: abuse confidence score (0-100), report count, ISP, usage type, country. Use to vet inbound connections, log entries, or suspicious hosts.

Parameters1

string

required

IPv4 or IPv6 address

Raw schema

{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string",
      "description": "IPv4 or IPv6 address"
    }
  },
  "required": [
    "ip"
  ]
}

README.md3 KBView on GitHub

Security Intel MCP — by SelfLabbs

Security intelligence for AI agents. Give your agent the ability to check CVEs, package vulnerabilities, malicious URLs, and IP reputation before it trusts a dependency, fetches a link, or approves a host.

Agents make security-relevant decisions constantly — installing packages, following URLs, evaluating logs. This server puts threat intel in the loop.

Tools

Tool	What it does	Source
`cve_lookup`	CVE summary: CVSS score, severity, CISA KEV (actively-exploited) status, fixes, references	NVD
`package_vulnerabilities`	Known vulns for any package/version across npm, PyPI, Go, Maven, crates.io, RubyGems + more	OSV.dev
`url_check`	Is this URL a known malware/phishing distribution site?	URLhaus (abuse.ch)
`ip_reputation`	Abuse confidence score, report history, ISP, Tor status for any IP	AbuseIPDB

Quick start (hosted — recommended)

No install. Add the remote server to your client:

Claude Code

bash

claude mcp add --transport http security-intel https://mcp.selflabbs.com/mcp

Claude Desktop / other clients (via mcp-remote)

json

{
  "mcpServers": {
    "security-intel": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.selflabbs.com/mcp"]
    }
  }
}

Cursor — Settings → MCP → Add server → URL: https://mcp.selflabbs.com/mcp

Self-host (Cloudflare Workers, free tier)

Create a Worker in the Cloudflare dashboard, paste worker.js
Settings → Variables, add:
- ABUSEIPDB_KEY — free at abuseipdb.com (enables ip_reputation)
- URLHAUS_AUTH_KEY — free at auth.abuse.ch (enables url_check)
- SERVER_API_KEY — optional; set to require Authorization: Bearer <key> from clients
Deploy. Your endpoint is https://<worker>.<account>.workers.dev/mcp

cve_lookup and package_vulnerabilities work with zero keys.

Example agent workflows

"Before adding this npm package, check it for known vulnerabilities" → package_vulnerabilities
"Is CVE-2024-3094 actively exploited? Do I need to act today?" → cve_lookup (KEV status)
"Vet the IPs in this auth log" → ip_reputation
"Check this download link before I fetch it" → url_check

Pricing

Hosted free tier: fair-use. Higher-volume plans: see selflabbs.com.

License

MIT (this repo). Data provided by NVD, OSV.dev, abuse.ch, and AbuseIPDB under their respective terms — check their policies for commercial/high-volume use.

Install

Tools (4)

cve_lookuppackage_vulnerabilitiesurl_checkip_reputation

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://security-intel-mcp.greenfield1775.workers.dev/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "security-intel-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://security-intel-mcp.greenfield1775.workers.dev/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.