Vulnerability Intelligence MCP for AI Agents

Q: Can it stop my agent hallucinating CVEs?

Yes. verify_cve_claim fact-checks a CVE assertion (exists, affected version, severity, exploited) against the fused sources and returns a per-assertion verdict with evidence.

Q: How do I connect it to Claude or Cursor?

Add it as an HTTP MCP server with your key, using the claude mcp add command or the mcpServers config above.

vulntel is a Model Context Protocol (MCP) server that gives an AI agent source-grounded vulnerability intelligence. It fuses NVD, CISA KEV, FIRST EPSS, OSV/GHSA and CISA SSVC into one exploitation-first answer, and it fact-checks the CVEs an agent might invent. Point any MCP client (Claude, Cursor, or your own agent) at it and your agent can triage, enrich, and verify vulnerabilities without you wiring up five separate feeds.

What is a vulnerability intelligence MCP?

An MCP server exposes tools an AI agent can call directly. A vulnerability intelligence MCP exposes those tools over live CVE data: instead of your agent scraping NVD or guessing from training data, it calls a tool and gets a grounded, cited answer. That matters because agents confidently invent CVE details. vulntel returns facts with their sources, and can verify a CVE claim before your agent acts on it.

How to connect vulntel to your AI agent

The server is live at mcp.rozetyp.com (a vulntel.com endpoint is on the way). Get a free key, then:

Claude Code:

claude mcp add --transport http vulntel https://mcp.rozetyp.com/mcp \
  --header "Authorization: Bearer YOUR_KEY"

Cursor / Claude Desktop / any generic MCP client (mcpServers):

{
  "mcpServers": {
    "vulntel": {
      "url": "https://mcp.rozetyp.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

It is a Streamable-HTTP MCP server with bearer auth. Once connected, your agent can call the tools below by name.

What vulntel's tools do

These are the six you reach for most (twelve tools ship in all: see the full tools reference):

hunt_plan : turn a recon'd stack into a ranked dig-order, plus the recurring weak spots to check first.
check_technology : the version-specific CVEs for one product.
search_vulns : find CVEs by concept, keyword, or a seed CVE's mechanism (keyword and semantic search fused); also serves the recent high-risk window by product.
verify_cve_claim : fact-check a CVE assertion (does it exist, does it affect this version, what severity, is it exploited) and catch hallucinations.
enrich_cve : dig into one finding: KEV status, EPSS score, SSVC decision, PoC signal.
search_public_code : find public repos that copied a given code string, to see how a bug was fixed or spot unpatched vendored copies.

How vulntel fuses NVD, KEV, EPSS, OSV, and SSVC

One CVE, five signals, in a single answer:

NVD : the base record and CVSS.
CISA KEV : is it known-exploited in the wild (the strongest prioritization signal).
FIRST EPSS : the probability it will be exploited in the next 30 days.
OSV / GHSA : the open-source and ecosystem advisory view.
CISA SSVC : the exploitation / automatable / technical-impact decision.
Plus a live public-exploit (PoC) signal.

Most APIs give you one or two of these and leave you to join the rest. vulntel returns them fused and exploitation-first, so an agent can prioritize, not just look up. For the evidence that this ordering matters, see what actually predicts exploitation.

vulntel vs building it yourself

You can call NVD, EPSS, KEV, and OSV directly. But then you own the rate limits, the schema drift, the join logic, the PoC-signal collection, and the hallucination problem when an agent fills gaps with invented details. vulntel is that pipeline as one MCP tool call, grounded and cited. For a side-by-side against other services, see the vulnerability intelligence API comparison.

FAQ

Is vulntel an MCP server? Yes. It is a hosted MCP (Model Context Protocol) server for vulnerability intelligence; connect any MCP client with an API key.

What data sources does it use? NVD, CISA KEV, FIRST EPSS, OSV/GHSA, CISA SSVC, and a live public-exploit signal, fused per CVE and refreshed daily.

Can it stop my agent hallucinating CVEs? Yes. verify_cve_claim fact-checks a CVE assertion (exists, affected version, severity, exploited) against the fused sources and returns a per-assertion verdict with evidence.

How do I connect it to Claude or Cursor? Add it as an HTTP MCP server with your key, using the claude mcp add command or the mcpServers config above.

Is it free? Yes, for authorized security research and defensive triage. Get a key with your email.