Vulnerability Exposure

Name: Vulnerability Exposure
Author: MRFrazer25

by MRFrazer25version 1.2.0i★ –iRuns on your computer

Registry nameio.github.MRFrazer25/vulnerability-exposure-mcp

Install

Overview

Description from the maker (original English)

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Cybersecurity
You need to fill in: SHODAN_API_KEY, VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, NVD_API_KEY, GREYNOISE_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: SHODAN_API_KEY, VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, NVD_API_KEY, GREYNOISE_API_KEY

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "vulnerability-exposure": {
      "command": "uvx",
      "args": [
        "vulnerability-exposure-mcp"
      ],
      "env": {
        "SHODAN_API_KEY": "your-value",
        "VIRUSTOTAL_API_KEY": "your-value",
        "ABUSEIPDB_API_KEY": "your-value",
        "NVD_API_KEY": "your-value",
        "GREYNOISE_API_KEY": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add vulnerability-exposure --env SHODAN_API_KEY=your-value --env VIRUSTOTAL_API_KEY=your-value --env ABUSEIPDB_API_KEY=your-value --env NVD_API_KEY=your-value --env GREYNOISE_API_KEY=your-value -- uvx vulnerability-exposure-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "vulnerability-exposure": {
      "command": "uvx",
      "args": [
        "vulnerability-exposure-mcp"
      ],
      "env": {
        "SHODAN_API_KEY": "your-value",
        "VIRUSTOTAL_API_KEY": "your-value",
        "ABUSEIPDB_API_KEY": "your-value",
        "NVD_API_KEY": "your-value",
        "GREYNOISE_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "vulnerability-exposure": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "vulnerability-exposure-mcp"
      ],
      "env": {
        "SHODAN_API_KEY": "your-value",
        "VIRUSTOTAL_API_KEY": "your-value",
        "ABUSEIPDB_API_KEY": "your-value",
        "NVD_API_KEY": "your-value",
        "GREYNOISE_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

SHODAN_API_KEY secret env
Shodan key for service banners (optional: without it the free InternetDB is used)
VIRUSTOTAL_API_KEY secret env
VirusTotal key for IP and domain reputation (optional)
ABUSEIPDB_API_KEY secret env
AbuseIPDB key for IP abuse reports (optional)
NVD_API_KEY secret env
NVD key for a higher rate limit, so version checks run faster (optional)
GREYNOISE_API_KEY secret env
GreyNoise key for more scanner lookups (optional; work-email accounts only)

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account MRFrazer25, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Cybersecurityi

More stars than 0% of the other 997 servers in this category
Published to the registry more recently than 85% of the other 997 servers in this category
Basic checks equal to or better than 100% of the other 997 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Vulnerability Exposure safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: SHODAN_API_KEY, VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, NVD_API_KEY, GREYNOISE_API_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.2.0) reached the registry 7 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: LucidShark, Threatist, Draugr

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

LucidShark

by toniantunovi

Local code quality and security scanner: lint, types, SAST, SCA, tests, coverage.

Runs on your computerUpdated today

Install

Threatist

by threatist.io

Vulnerability records: CVE, GHSA, CISA KEV, EPSS and vendor fixes in one place. No key needed.

Runs in the cloudUpdated today

Install

Draugr

by draugr-dev

Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Vulnerability Exposure MCP

An MCP server that checks public IPs, domains, CVEs and software versions for confirmed vulnerabilities and exposure. A CVE only counts as affecting a version when NVD's version ranges confirm it; everything else is listed for review, so related or vendor-wide CVEs are never reported as yours.

It's the MCP version of Vulnerability Exposure Analyzer. The app needs a Cohere key to run its own agent; this one doesn't need any LLM key, because the model in your MCP client calls the tools and writes the report.

It runs locally over stdio, so it works with clients that launch local MCP servers: Claude Desktop, Claude Code, Codex, Cursor, Antigravity, Windsurf, VS Code, LM Studio and similar. Web-only clients such as ChatGPT on the web and claude.ai connectors only accept remote (HTTPS) servers; this server is not hosted, because a public deployment would need its own authentication to keep your API keys from being used by anyone.

Give it a public IP, a domain, a CVE ID (CVE-2026-111497), a product and version (PHP 8.3.10, OpenSSH 8.9p1 Ubuntu-3ubuntu0.6), or your project's lockfile or SBOM, and it pulls evidence from NVD, CISA KEV, FIRST EPSS, Exploit-DB, OSV.dev, Shodan, VirusTotal, AbuseIPDB, Spamhaus, GreyNoise, SANS ISC, the internet registries and certificate transparency logs.

Install

Requires Python 3.11+. Setup is three steps: install, optionally store your keys, connect your AI client.

The simplest way is uv, which runs the server straight from PyPI with nothing to set up:

uvx vulnerability-exposure-mcp keys status

Or install it with pip (pip install vulnerability-exposure-mcp) and use the vulnerability-exposure-mcp command the same way. To run from source instead, see From source below.

Free keys: Shodan, VirusTotal, AbuseIPDB, NVD (optional, raises the rate limit), GreyNoise (optional; GreyNoise only gives keys to accounts made with a work email, not Gmail or similar. Without one it allows a limited number of lookups, and SANS ISC covers the rest). CVE and software checks work with no keys at all. IP and domain checks also run without keys, using Shodan's free InternetDB, the internet registries, Spamhaus DROP and GreyNoise; the report then lists VirusTotal and AbuseIPDB as not checked.

Then ask: *"Run a security assessment of PHP 8.3.10"* or use the security_assessment prompt. Examples has more to try.

Store your keys securely

Keys can live in your operating system's credential store (Windows Credential Manager, macOS Keychain, or the Secret Service on Linux) instead of a config file. Run this in your own terminal; the key is typed into a hidden prompt and goes straight to the store:

uvx vulnerability-exposure-mcp keys set shodan

Do the same for virustotal, abuseipdb, nvd and greynoise as needed. keys status shows which are stored (never their values) and keys delete NAME removes one. With keys stored this way, leave the env block below empty. An environment variable, if set, takes precedence over a stored key.

Servers, Docker containers and other headless Linux systems usually have no credential store. There keys set says so, and keys go in the env block instead.

Connect a client

Pass keys through the client's env block, not the command line.

Claude Desktop

Download vulnerability-exposure-mcp- .mcpb from the latest release and open it: Claude Desktop installs it and asks for your (optional) keys in a form. Or add the JSON config below. From 1.1.0 each bundle has a signed build provenance attestation, so you can check it was built by this repository's release workflow: gh attestation verify vulnerability-exposure-mcp- .mcpb --repo MRFrazer25/Vulnerability-Exposure-MCP.

Claude Code

Store your keys first (see above), so none go on the command line, then run:

claude mcp add vulnerability-exposure -- uvx vulnerability-exposure-mcp

Start a new Claude Code session afterwards: MCP servers load when a session starts.

Or install it as a plugin, which asks for each (optional) key in a masked prompt and keeps it in your credential store:

/plugin marketplace add MRFrazer25/Vulnerability-Exposure-MCP

/plugin install vulnerability-exposure@vulnerability-exposure

Codex (CLI, IDE extension and ChatGPT desktop app)

Store your keys first (see above), so none go on the command line, then run:

codex mcp add vulnerability-exposure -- uvx vulnerability-exposure-mcp

Or add it to ~/.codex/config.toml, which all three share:

[mcp_servers.vulnerability-exposure]

command = "uvx" args = ["vulnerability-exposure-mcp"]

Antigravity CLI

Store your keys first (see above), then install the plugin straight from this repo:

agy plugin install https://github.com/MRFrazer25/Vulnerability-Exposure-MCP/tree/main/plugin

Cursor, Windsurf, VS Code, Claude Desktop and other JSON-configured clients

Add this to the client's MCP config (in Claude Desktop: Settings → Developer → Edit Config), then restart the client. With keys stored in the credential store, leave the env values empty or remove the block.

"mcpServers": { "vulnerability-exposure": { "command": "uvx", "args": ["vulnerability-exposure-mcp"], "env": { "SHODAN_API_KEY": "", "VIRUSTOTAL_API_KEY": "", "ABUSEIPDB_API_KEY": "", "NVD_API_KEY": "", "GREYNOISE_API_KEY": "" } } } }

(VS Code uses "servers" instead of "mcpServers" in .vscode/mcp.json.)

Docker

Build the image once with docker build -t vulnerability-exposure-mcp ., then point the client at it. Containers have no credential store, so keys go in env; listing them as bare -e names passes their values through without putting them on the command line:

"mcpServers": { "vulnerability-exposure": { "command": "docker", "args": ["run", "-i", "--rm", "-e", "SHODAN_API_KEY", "-e", "VIRUSTOTAL_API_KEY", "-e", "ABUSEIPDB_API_KEY", "-e", "NVD_API_KEY", "-e", "GREYNOISE_API_KEY", "vulnerability-exposure-mcp"], "env": { "SHODAN_API_KEY": "", "VIRUSTOTAL_API_KEY": "", "ABUSEIPDB_API_KEY": "", "NVD_API_KEY": "", "GREYNOISE_API_KEY": "" } } } }

From source

git clone https://github.com/MRFrazer25/Vulnerability-Exposure-MCP.git

cd Vulnerability-Exposure-MCP python -m venv .venv .venv/Scripts/python -m pip install -e . # macOS/Linux: .venv/bin/python

Then use .venv/Scripts/python -m vulnerability_exposure_mcp (on macOS or Linux, .venv/bin/python) wherever the steps above say uvx vulnerability-exposure-mcp, with the full path to that Python in client configs, for example "command": "C:/path/to/Vulnerability-Exposure-MCP/.venv/Scripts/python.exe", "args": ["-m", "vulnerability_exposure_mcp"].

It keeps everything that makes the original app's reports reliable:

The same analyst rules as the app's system prompt. The server's instructions are a short summary, since clients cut long ones short; investigate_target returns the full rules and report format as analyst_guide.
Baseline lookups run in code, so reputation and exposure checks never depend on the model remembering them.
Analysis depth (Quick Scan, Standard, Comprehensive, Expert) sets the tool-call budget, per-service caps and how much detail each result keeps. The model can't override these limits.
Key facts computed from the data, not the model, including the CISA KEV split into *confirmed for this target* and *related*, so the numbers are the same whichever model runs it.
Fresher and more accurate than NVD alone: Ubuntu and Debian packages are checked against the distro's own fix data, so backported fixes count; recent CVEs NVD hasn't analysed are listed for review; and for packages such as Next.js, React and Django, GitHub advisories fill gaps before NVD has them. Each CVE carries its patch status and whether exploit code is published.
One investigation per `investigation_id`: a random handle returned by investigate_target, so several chats sharing one server process never mix evidence.

How this differs

Most CVE servers search NVD by keyword or product and hand back every match, so a report on nginx 1.30.0 can list CVEs that were fixed years earlier. This one:

Checks the exact version. A CVE is *confirmed* only when NVD's version ranges include that version, and for an Ubuntu or Debian package, CVEs the distro fixed by backport are ruled out. Keyword and product-level matches are listed separately as *related*.
Sets aside what isn't the product's. Plugin CVEs (Jenkins plugins), other products that share the name (Nginx Proxy Manager, Grafana Alloy) and CVEs NVD confirms only on another OS (PHP on Windows, for a Linux build) are listed separately instead of being counted against it.
Combines the context a fix decision needs. One call returns CISA KEV status and ransomware use, EPSS and whether it's rising, the minimum safe version (and how far your current major version gets), end-of-life status, published exploits and patch status, instead of the model stitching together separate lookups.
Checks the report, not just the data. check_report flags a draft that cites a CVE, version or host name no tool returned, calls a related CVE confirmed, swaps an affected and an unaffected version, or gets a fix version, count, KEV, port, reputati

Only the beginning is shown; read the rest in the repo

Vulnerability Exposure

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Cybersecurityi

Common questions

Alternatives

LucidShark

Threatist

Draugr

README from the maker

Vulnerability Exposure MCP

Install

Store your keys securely

Connect a client

From source

How this differs