Vulnerability records: CVE, GHSA, CISA KEV, EPSS and vendor fixes in one place. No key needed.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
A Red Hat RHSA or Microsoft KB or ADV with its CVEs and records.
An advisory id such as RHSA-2024:0001, KB5034441 or ADV240001
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http threatist https://threatist.io/mcp
A Red Hat RHSA or Microsoft KB or ADV with its CVEs and records.
| Argument | Type | Description |
|---|---|---|
| id* | string | An advisory id such as RHSA-2024:0001, KB5034441 or ADV240001 |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "An advisory id such as RHSA-2024:0001, KB5034441 or ADV240001"
}
},
"additionalProperties": false
}A vendor's records, highest priority first. Takes the same filters as search_vulnerabilities.
| Argument | Type | Description |
|---|---|---|
| q | string | Words to look for in the title, description, products and ids |
| cwe | array | CWE ids such as CWE-79, any of |
| band | array | Priority bands, any of |
| sort | string | Order of the results; relevance needs q |
| limit | integer | Records per page, 1 to 100 (default 10) |
| cursor | string | The next value of the previous page |
| signal | array | Signals, all of: kev (in CISA KEV), fix (a fix is listed), nofix (no fix listed), cve (has a CVE id) |
| vendor* | string | A vendor key such as microsoft, apache or schneider-electric (lowercase, spaces as hyphens) |
| product | array | Product names, any of |
| component | string | A component of the vendor, as on the vendor's page; needs vendor |
| exploited | boolean | Only records in CISA KEV |
| fixStatus | array | Fix states, any of |
| published | string | Published within the last 7 days, 30 days or 12 months |
| impactType | array | Impact types, any of |
{
"type": "object",
"required": [
"vendor"
],
"properties": {
"q": {
"type": "string",
"description": "Words to look for in the title, description, products and ids"
},
"cwe": {
"type": "array",
"items": {
"type": "string"
},
"description": "CWE ids such as CWE-79, any of"
},
"band": {
"type": "array",
"items": {
"enum": [
"CRITICAL",
"HIGH",
"MEDIUM",
"LOW"
],
"type": "string"
},
"description": "Priority bands, any of"
},
"sort": {
"enum": [
"relevance",
"newest",
"priority",
"cvss",
"epss"
],
"type": "string",
"description": "Order of the results; relevance needs q"
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Records per page, 1 to 100 (default 10)"
},
"cursor": {
"type": "string",
"description": "The next value of the previous page"
},
"signal": {
"type": "array",
"items": {
"enum": [
"kev",
"fix",
"nofix",
"cve"
],
"type": "string"
},
"description": "Signals, all of: kev (in CISA KEV), fix (a fix is listed), nofix (no fix listed), cve (has a CVE id)"
},
"vendor": {
"type": "string",
"description": "A vendor key such as microsoft, apache or schneider-electric (lowercase, spaces as hyphens)"
},
"product": {
"type": "array",
"items": {
"type": "string"
},
"description": "Product names, any of"
},
"component": {
"type": "string",
"description": "A component of the vendor, as on the vendor's page; needs vendor"
},
"exploited": {
"type": "boolean",
"description": "Only records in CISA KEV"
},
"fixStatus": {
"type": "array",
"items": {
"enum": [
"fixed",
"partial",
"will_not_fix",
"deferred",
"no_fix_listed"
],
"type": "string"
},
"description": "Fix states, any of"
},
"published": {
"enum": [
"7d",
"30d",
"12m"
],
"type": "string",
"description": "Published within the last 7 days, 30 days or 12 months"
},
"impactType": {
"type": "array",
"items": {
"enum": [
"code_execution",
"privilege_escalation",
"security_bypass",
"information_disclosure",
"tampering",
"denial_of_service",
"spoofing",
"cross_site_scripting",
"sql_injection"
],
"type": "string"
},
"description": "Impact types, any of"
},
"privileges": {
"enum": [
"none"
],
"type": "string",
"description": "none: no privileges required"
},
"attackVector": {
"type": "array",
"items": {
"enum": [
"network",
"adjacent",
"local",
"physical"
],
"type": "string"
},
"description": "Attack vectors from the CVSS vector, any of"
},
"userInteraction": {
"enum": [
"none"
],
"type": "string",
"description": "none: no user interaction required"
}
},
"additionalProperties": false
}A record for a TI id or an alias such as a CVE or GHSA id. Merged ids give the surviving record. By default the record is shortened: no CPE matches, at most 20 references (exploits and patches first) and the 10 newest advisories; trimmed says what was cut.
| Argument | Type | Description |
|---|---|---|
| id* | string | A Threatist id such as TI-2021-19919, or an alias such as CVE-2021-44228 or GHSA-jfh8-c2jp-5v3q |
| full | boolean | true: the whole record, as the REST API gives it, with every CPE match, reference and advisory |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "A Threatist id such as TI-2021-19919, or an alias such as CVE-2021-44228 or GHSA-jfh8-c2jp-5v3q"
},
"full": {
"type": "boolean",
"description": "true: the whole record, as the REST API gives it, with every CPE match, reference and advisory"
}
},
"additionalProperties": false
}Recent additions to CISA's Known Exploited Vulnerabilities catalogue. Newest first, each with its Threatist record.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Entries per page, 1 to 100 (default 10) |
| since | string | Added within the last 7, 30 or 90 days, or all (default 7d) |
| cursor | string | The next value of the previous page |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Entries per page, 1 to 100 (default 10)"
},
"since": {
"enum": [
"7d",
"30d",
"90d",
"all"
],
"type": "string",
"description": "Added within the last 7, 30 or 90 days, or all (default 7d)"
},
"cursor": {
"type": "string",
"description": "The next value of the previous page"
}
},
"additionalProperties": false
}Records matching a text and filters, a page at a time. Pass next as cursor for the next page.
| Argument | Type | Description |
|---|---|---|
| q | string | Words to look for in the title, description, products and ids |
| cwe | array | CWE ids such as CWE-79, any of |
| band | array | Priority bands, any of |
| sort | string | Order of the results; relevance needs q |
| limit | integer | Records per page, 1 to 100 (default 10) |
| cursor | string | The next value of the previous page |
| signal | array | Signals, all of: kev (in CISA KEV), fix (a fix is listed), nofix (no fix listed), cve (has a CVE id) |
| vendor | string | A vendor key such as microsoft or schneider-electric |
| product | array | Product names, any of |
| component |
We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 7, 2026.
| privileges | string | none: no privileges required |
| attackVector | array | Attack vectors from the CVSS vector, any of |
| userInteraction | string | none: no user interaction required |
| string |
| A component of the vendor, as on the vendor's page; needs vendor |
| exploited | boolean | Only records in CISA KEV |
| fixStatus | array | Fix states, any of |
| published | string | Published within the last 7 days, 30 days or 12 months |
| impactType | array | Impact types, any of |
| privileges | string | none: no privileges required |
| attackVector | array | Attack vectors from the CVSS vector, any of |
| userInteraction | string | none: no user interaction required |
{
"type": "object",
"properties": {
"q": {
"type": "string",
"description": "Words to look for in the title, description, products and ids"
},
"cwe": {
"type": "array",
"items": {
"type": "string"
},
"description": "CWE ids such as CWE-79, any of"
},
"band": {
"type": "array",
"items": {
"enum": [
"CRITICAL",
"HIGH",
"MEDIUM",
"LOW"
],
"type": "string"
},
"description": "Priority bands, any of"
},
"sort": {
"enum": [
"relevance",
"newest",
"priority",
"cvss",
"epss"
],
"type": "string",
"description": "Order of the results; relevance needs q"
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Records per page, 1 to 100 (default 10)"
},
"cursor": {
"type": "string",
"description": "The next value of the previous page"
},
"signal": {
"type": "array",
"items": {
"enum": [
"kev",
"fix",
"nofix",
"cve"
],
"type": "string"
},
"description": "Signals, all of: kev (in CISA KEV), fix (a fix is listed), nofix (no fix listed), cve (has a CVE id)"
},
"vendor": {
"type": "string",
"description": "A vendor key such as microsoft or schneider-electric"
},
"product": {
"type": "array",
"items": {
"type": "string"
},
"description": "Product names, any of"
},
"component": {
"type": "string",
"description": "A component of the vendor, as on the vendor's page; needs vendor"
},
"exploited": {
"type": "boolean",
"description": "Only records in CISA KEV"
},
"fixStatus": {
"type": "array",
"items": {
"enum": [
"fixed",
"partial",
"will_not_fix",
"deferred",
"no_fix_listed"
],
"type": "string"
},
"description": "Fix states, any of"
},
"published": {
"enum": [
"7d",
"30d",
"12m"
],
"type": "string",
"description": "Published within the last 7 days, 30 days or 12 months"
},
"impactType": {
"type": "array",
"items": {
"enum": [
"code_execution",
"privilege_escalation",
"security_bypass",
"information_disclosure",
"tampering",
"denial_of_service",
"spoofing",
"cross_site_scripting",
"sql_injection"
],
"type": "string"
},
"description": "Impact types, any of"
},
"privileges": {
"enum": [
"none"
],
"type": "string",
"description": "none: no privileges required"
},
"attackVector": {
"type": "array",
"items": {
"enum": [
"network",
"adjacent",
"local",
"physical"
],
"type": "string"
},
"description": "Attack vectors from the CVSS vector, any of"
},
"userInteraction": {
"enum": [
"none"
],
"type": "string",
"description": "none: no user interaction required"
}
},
"additionalProperties": false
}