Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Fetch a record by CVE ID, GHSA ID, or KEVWire record ID, including every source, measurement date, CISA deadline, and a permalink.
Fetch a record by CVE ID, GHSA ID, or KEVWire record ID, including every source, measurement date, CISA deadline, and a permalink.
| Argument | Type | Description |
|---|---|---|
| id* | string |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"maxLength": 200
}
},
"additionalProperties": false
}Every source KEVWire ingests, with scope, limitations, retrieval status, last success, and record counts. Use this to describe coverage honestly.
No arguments.
{
"type": "object",
"properties": {},
"additionalProperties": false
}Technology labels usable as filters, with how many records each covers. Optionally filter by text.
| Argument | Type | Description |
|---|---|---|
| limit | integer | |
| query | string |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 500,
"minimum": 1
},
"query": {
"type": "string",
"maxLength": 120
}
},
"additionalProperties": false
}Vulnerabilities with documented exploitation (CISA KEV or explicit reporting) published within the last N days, most urgent first.
| Argument | Type | Description |
|---|---|---|
| days | integer | |
| limit | integer |
{
"type": "object",
"properties": {
"days": {
"type": "integer",
"default": 30,
"maximum": 365,
"minimum": 1
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 50,
"minimum": 1
}
},
"additionalProperties": false
}Search the KEVWire corpus (CISA KEV, NVD high/critical CVEs, GitHub advisories, national CERTs, security reporting, editorial records). Default order is "urgent": the last 30 days first, then known exploitation, CVSS 9+, breaches. Every result includes source URLs to cite.
| Argument | Type | Description |
|---|---|---|
| kind | string | |
| sort | string | |
| limit | integer | |
| query | string | Words to match, e.g. "php rce", a CVE ID, a product, or an event name like "PHP2Shell". |
| offset | integer | |
| technologies | array | Technology labels, e.g. ["Microsoft Windows", "PHP"]. Matches any. |
| known_exploited_only | boolean | Only records in the CISA Known Exploited Vulnerabilities catalog. |
{
"type": "object",
"properties": {
"kind": {
"enum": [
"vulnerability",
"breach",
"advisory",
"ai-research"
],
"type": "string"
},
"sort": {
"enum": [
"urgent",
"newest",
"priority",
"cvss",
"epss"
],
"type": "string"
},
"limit": {
"type": "integer",
"default": 10,
"maximum": 50,
"minimum": 1
},
"query": {
"type": "string",
"maxLength": 500,
"description": "Words to match, e.g. \"php rce\", a CVE ID, a product, or an event name like \"PHP2Shell\"."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 100000,
"minimum": 0
},
"technologies": {
"type": "array",
"items": {
"type": "string",
"maxLength": 120
},
"maxItems": 50,
"description": "Technology labels, e.g. [\"Microsoft Windows\", \"PHP\"]. Matches any."
},
"known_exploited_only": {
"type": "boolean",
"description": "Only records in the CISA Known Exploited Vulnerabilities catalog."
}
},
"additionalProperties": false
}