Code-only MCP servers — agent-tools.cloud

MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.

Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.

cisa-kev-mcp

github.com/csoai-org/cisa-kev-mcp
updated this year

CISA Known Exploited Vulnerabilities feed + remediation deadlines for US federal + critical infrastructure operators.

pypi MIT License
purify-feeds-mcp

github.com/eason4kim-rocket/purify-feeds-mcp
updated this year

MCP server for Purify security-intelligence feeds (CISA KEV / EPSS) with per-record provenance

MIT
depguard

github.com/the-ai-entrepreneur-ai-hub/depguard
active

Dependency vulnerability scanner over OSV.dev with CISA KEV actively-exploited flags. No API key.
mcp-server-cve-intel

github.com/gopichand458/mcp-server-cve-intel
updated this year

Multi-source CVE Intelligence MCP Server — combines NVD, CISA KEV, and EPSS for AI-powered vulnerability analysis

MIT ★ 1
Vuln-Search-MCP

github.com/Nislive/Vuln-Search-MCP
updated this year

MCP server for vulnerability assessment — searches NVD, CISA KEV & GitHub PoCs with RAG-powered semantic search over HackTricks & PayloadsAllTheThings.

MIT
nvd-mcp

github.com/CedricG-dev/nvd-mcp
active

:robot: MCP server exposing NVD, EPSS, and CISA KEV vulnerability data as tools for LLM agents — query and prioritize CVEs offline via a synced SQLite database

★ 2
vuln-priority-mcp

github.com/arhancanli/vuln-priority-mcp
active

Which vulnerabilities to fix first: CISA KEV, EPSS, CVSS and CISA's SSVC decisions in one ranking.

MIT ★ 2
mcp-server

github.com/notcve/mcp-server
updated this year

NotCVE MCP server — live vulnerability intelligence for AI agents: 365k+ CVEs/NotCVEs, CVSS, EPSS, CISA KEV, affected versions, exploits and patches from 80+ sources.

MIT
contrastapi

github.com/UPinar/contrastapi
active

Security intelligence API and MCP server in C: CVE, KEV, EPSS, package, domain and IP lookups, and a watch list that reports what changed.

AGPL-3.0 ★ 37
vuln-triage-mcp

github.com/kimmawla/vuln-triage-mcp
active

MCP server that tells your AI agent which vulnerabilities to fix first: OSV.dev + EPSS + CISA KEV combined into one explainable priority score.

MIT
cverdict

github.com/markusweldon/cverdict
active

Every CVE gets a verdict. Every verdict comes with receipts. Open-source CVE triage from CISA KEV, EPSS and public exploit feeds, rebuilt hourly, with open feeds and an MCP server.

npm MIT ★ 1
pentest-suite

github.com/laurentvv/pentest-suite
active

Lightweight attack-surface discovery and vulnerability intelligence toolkit in pure Python stdlib (zero dependencies), with CISA KEV/cve.now feeds, OODA loop orchestration, and MCP server.

MIT
antigravity-tiered-router

github.com/stankfoo/antigravity-tiered-router
active

Intelligent 3-tier task routing and active uncertainty fallback (Antiback) for Google Antigravity IDE. Powered by native Kev-0.8B (System One) and deterministic heuristics.

MIT ★ 1
opencraysec

github.com/amgio38/opencraysec
active

Dependency vulnerability checker for AI assistants: a CLI, an MCP server and a local dashboard. Scans Rust, JS/TS, PHP, Go and Python lockfiles against OSV, ranked by CISA KEV and EPSS.

MIT ★ 1
vuln-watch

github.com/simonjamescarroll/vuln-watch
active

Hourly answer to "does this new vulnerability affect what I actually run?" SSH inventory, OSV/KEV/Chrome matching, read-only agent triage, and an MCP server for your coding agent.

MIT
patchbell

github.com/kemal-arslan/patchbell
active

Get told when software you run has a serious vulnerability, and only then. A local-first CVE watchlist with CISA KEV and EPSS filtering, notifications, a GitHub Action and an MCP server.

MIT
radar-mcp

github.com/offseq/radar-mcp
active

OffSeq Threat Radar MCP server: CVE, CISA KEV, EPSS and exploit intelligence, SBOM scans and IOC checks for coding agents. Gemini CLI extension and Claude Code plugin.

MIT
secops-field-notes-mcp

github.com/getlarkwright/secops-field-notes-mcp
active

Free MCP server for security operations: CVSS 3.1 scoring, IOC extraction and defanging, email header triage, hash and JWT decoding, timestamps, layered decoding, CISA KEV lookup. No account, no telemetry.

MIT
Threat_Intelligence_Pipeline

github.com/NullSpace-BitCradle/Threat_Intelligence_Pipeline
active

Correlates every NVD CVE with CWE, CAPEC, ATT&CK, D3FEND, OWASP, CISA KEV, Vulnrichment SSVC, and EPSS, with APT links only where MITRE ATT&CK cites the CVE. Search-first web app, MCP server, daily fail-closed updates via GitHub Actions.

NOASSERTION ★ 1
oxiploitability-mcp

github.com/abelreqma/oxiploitability-mcp
active

Rust MCP server for sourced CVE research, combining NVD records, EPSS probabilities, CISA KEV entries, OSV package advisories, CVE.org records and a public proof-of-concept index. It can also check supported SBOMs, lockfiles, project directories and container images.

Apache-2.0 ★ 1
copilot-mcp-soc-pack

github.com/NobufumiMurata/copilot-mcp-soc-pack
updated this year

Community SOC Pack for Microsoft Security Copilot. Free-API MCP server and OpenAPI plugin bundle (KEV, EPSS, MITRE ATTACK, Abuse.ch, GreyNoise, AbuseIPDB, crt.sh, ransomware.live, etc.) with one-click Deploy to Azure.

MIT
Vulnerability-Exposure-MCP

github.com/MRFrazer25/Vulnerability-Exposure-MCP
active

MCP server that checks public IPs, domains, CVEs and software versions for confirmed vulnerabilities and exposure (NVD, CISA KEV, EPSS, OSV.dev, Shodan and more), with Ubuntu/Debian backport checks and a report checker. Works with Claude, Cursor and VS Code; no LLM key needed.

MIT ★ 1
doraoracle

github.com/ToolOracle/doraoracle
updated this year

DORA Threat Intelligence — 15 MCP tools for CVE, CISA KEV, CERT-Bund, MITRE, HIBP

NOASSERTION
security-framework-mcp

github.com/zer0-kr/security-framework-mcp
updated this year

Unified NIST + OWASP security framework MCP server — 36 tools, 3439+ records, live NVD/KEV, PDF reading, STRIDE threat modeling, compliance mapping

MIT ★ 14
mcp-vulnerability-research

github.com/No3214/mcp-vulnerability-research
active

Read-only MCP server for vulnerability research with OSV, NVD, KEV, EPSS, and deps.dev. Source context and explicit pagination.

MIT
nvd-mcp-server

github.com/Alig1493/nvd-mcp-server
updated this year

MCP server for the NIST National Vulnerability Database — lets AI assistants search CVEs by keyword, severity, CPE, CWE, KEV status, and date range via natural language.

GPL-3.0 ★ 1
open-source-supply-chain-risk-mcp

github.com/apifyforge/open-source-supply-chain-risk-mcp
updated this year

Open source supply chain risk analysis via MCP — give your AI agent direct access to CVE records, CISA KEV exploits, maintainer bus-factor scores, and typosquat detection across 7 live intelligence sources.

MIT
@mcpskillsio/server

github.com/bebravebekind/mcpskills-server
updated this year

Use the MCPSkills pre-install trust layer from Claude Code, Cursor, or any MCP client. Accepts GitHub repos, npm packages, Smithery URLs, and OpenClaw skills. 15 signals (incl. OSV/KEV/EPSS vulnerability intelligence), safety scanning, OpenClaw frontmatte

npm MIT
open-source-software-supply-chain-mcp

github.com/apifyforge/open-source-software-supply-chain-mcp
updated this year

Open source supply chain risk assessment for AppSec teams, engineering leads, and platform engineers who need more than a CVE scanner. This MCP server aggregates 7 live data sources — GitHub, NVD, CISA KEV, StackExchange, Hacker News, Federal Register, and Congress.

MIT
cve-lookup

github.com/nlink-jp/cve-lookup
active

Context for a CVE from EchelonGraph’s CVE Pulse API (CLI + MCP) — CVSS, CISA KEV, EPSS, SSVC, exploit and patch signals, product matching, vendor advisories and the internet-exposure footprint. No key or account: a single dependency-free binary in place of the vendor’s npx-launched MCP server

MIT ★ 1
kanareika

github.com/mikekosulin/kanareika
active

Agentless, read-only security audit of Linux servers over SSH. Ranks what to patch first: CVEs with KEV and EPSS, SSH access, exposed ports, host health, with rollback-ready fixes. Terminal UI (TUI), web UI and an MCP server in one Go binary. No telemetry.

MIT ★ 8
crowbar

github.com/kushvinth/crowbar
active

Retrieve CVEs and index them inside your codebase. Offline CVE + exploit intelligence: one SQLite index, one CLI, one MCP server.

npm MIT ★ 8
crowbar-cli

github.com/kushvinth/crowbar
active

Retrieve CVEs and index them inside your codebase. One SQLite+FTS5 index, one CLI, one MCP server. Never answer a CVE from memory again.

npm MIT
pwned.coffee

github.com/pwned-coffee/pwned.coffee
active

Live security incidents with fix status, fixed versions and sources. MCP server, JSON/RSS feeds, lockfile check. Docs and issues only; the site's code is not open source.

CC-BY-4.0
cve-intel

github.com/Fazmin/cve-intel
active

Local security intelligence for CVE triage and remediation, with built-in SBOM functionality. 46 data sources and 42 tools, risk scores, fix plans for what you run, and an MCP server for AI agents - all built in native Rust. Private by default.

Apache-2.0 ★ 147