Security

CISA KEV MCP Server

Chat with AI and run tools instantly — no account needed.

The CISA Known Exploited Vulnerabilities (KEV) Catalog is the authoritative U.S. government list of vulnerabilities that are actively being exploited in the wild. Federal agencies are required to remediate KEV entries by their due dates. Search the catalog, look up specific CVEs, find recently added entries, filter by ransomware campaign use, and get summary stats.

9 tools
Agent guide included
Try it Free

No account needed. Chat with AI and run tools instantly.

Browse all tools

AI Skill
SKILL.md

Domain knowledge for CISA KEV — workflow patterns, data models, and gotchas for your AI agent.

CISA KEV

The CISA Known Exploited Vulnerabilities Catalog lists vulnerabilities actively exploited in the wild. Federal agencies must remediate by due dates.

Data Model

  • Catalog operations — summary counts, single-CVE lookups, and free-text search across titles/vendors.
  • Temporal slices — recently added entries and ransomware-tagged subsets.
  • Operational views — batch triage helpers, due-date windows, CWE aggregates, and vendor exposure rollups.

Gotchas

  • Bulk download: Catalog is fetched as bulk. Rate limit 20/min. Cache results.

Tools in this Server (9)

Cwe Breakdown

Get a frequency breakdown of weakness types (CWEs) across all CISA KEV entries. Shows which vulnerability classes are most commonly exploited in the w...

Due Soon

Find CISA KEV entries with past-due or upcoming federal remediation deadlines. Overdue entries represent federally mandated patches that haven't been ...

Lookup

Look up a specific CVE in the CISA Known Exploited Vulnerabilities catalog. Returns full KEV entry details including the required remediation action, ...

Product Exposure

Get a KEV exposure breakdown for a specific vendor — how many actively exploited vulnerabilities affect each of their products, and which products hav...

Ransomware

Get CISA KEV entries that are linked to known ransomware campaigns. These are the highest-priority vulnerabilities — actively exploited AND used by ra...

Recent

Get the most recently added vulnerabilities to the CISA KEV catalog. Results are sorted newest-first. Use days_back to control the lookback window. Cr...

Search

Search the CISA KEV catalog by vendor, product, vulnerability name, or keyword. Case-insensitive full-text search across all fields. Use ransomware_on...

Stats

Get a summary of the CISA Known Exploited Vulnerabilities catalog: total count, catalog version, date released, how many were added in the last 7/30/9...

Triage

Check a list of CVEs from a vulnerability scan against the CISA KEV catalog. Returns which CVEs are confirmed actively exploited (in KEV), which are n...

Frequently Asked Questions

What is the CISA KEV MCP server?

The CISA Known Exploited Vulnerabilities (KEV) Catalog is the authoritative U.S. government list of vulnerabilities that are actively being exploited in the wild. Federal agencies are required to remediate KEV entries by their due dates. Search the catalog, look up specific CVEs, find recently added entries, filter by ransomware campaign use, and get summary stats. It provides 9 tools that AI agents can use through the Model Context Protocol (MCP).

How do I connect CISA KEV to my AI agent?

Add the MCPBundles server URL to your MCP client configuration (Claude Desktop, Cursor, VS Code, etc.). The URL format is: https://mcp.mcpbundles.com/bundle/cisa-kev. Authentication is handled automatically.

How many tools does CISA KEV provide?

CISA KEV provides 9 tools that can be called by AI agents, along with a SKILL.md that gives your AI agent domain knowledge about when and how to use them.

What authentication does CISA KEV require?

CISA KEV uses open data APIs — no authentication required.

Setup Instructions

Connect CISA KEV to any MCP client in minutes

https://mcp.mcpbundles.com/bundle/cisa-kev

What is MCP?

Model Context Protocol lets AI tools call external capabilities securely through a single URL. This bundle groups tools behind an MCP endpoint that many clients can use.

Use this bundle in 3 steps

  1. Copy the MCP URL above
  2. Open your AI tool and add a new MCP/connector
  3. Paste the URL and follow any auth prompts

Claude Desktop Users

Skip the manual setup! Use the .mcpb file format for one-click installation. Check the Claude Desktop tab for setup instructions.

Pick your tool tab for exact steps

Select ChatGPT, Cursor, Claude Code, or another tab for copy-paste config.

Try CISA KEV now

No sign-up required. Chat with AI and run tools instantly.

CISA KEV MCP Server & Skill — 9 Tools