Cisa Cybersecurity MCP Server

@cyanheads/cisa-cybersecurity-mcp-server CISA Known Exploited Vulnerabilities with BOD 26-04 deadlines, SSVC prioritization, and the full ICS advisory corpus (CSAF) via MCP. Keyless. STDIO or Streamable HTTP. 7 Tools • 2 Data Resources • 1 Skill

Public Hosted Server: https://cisa-cybersecurity.caseyjhand.com/mcp

Overview

CISA's vulnerability data in one place: the Known Exploited Vulnerabilities catalog with its remediation deadlines, per-CVE SSVC decision points, ICS advisories back to 2010, and CISA's latest alerts. Check a scan's worth of CVEs against KEV in one call, find what's overdue for a vendor, and work out BOD 26-04 timelines. No API key required.

Tools

Resources

Both data resources are fully covered by the tools above. The CISA cybersecurity guide covers evidence gates, CVE-to-product investigation, and incomplete coverage. It ships with plugin, npm, Docker, and MCPB installs and is served at skill://cisa-cybersecurity-guide/SKILL.md through MCP skill discovery.

Capability reference

cisa_list_reference tool

• One required topic: directives, kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources; reads in-process state only, so it answers while other tools are failing
• directives adds timelineTable (all 16 rows of BOD 26-04 Table 1, with remediationTimelineDays and forensicTriageRequired), definitions, and supersedes; sources reports the KEV catalogVersion, the advisory index's ready / documentCount / syncStatus, the SSVC cache TTL, and the cached feed windows

cisa_check_cve_status tool

• Processes up to 200 cveIds per call from the cached KEV snapshot with no upstream request; inputs up to 1,000 IDs return normalized unprocessedIds for a follow-up call. A CVE outside KEV comes back inKev: false, not as an error
• Per CVE: dateAdded, dueDate, daysUntilDue, overdue, requiredAction, knownRansomwareCampaignUse, forensicTriage, cwes[], every URL in the entry's notes as references[] typed by kind, and a three-state directive (BOD 26-04, BOD 22-01, or null); the response echoes the catalog snapshot and the asOf date the deadlines were computed against
• detail: "summary" trims each in-KEV record to the triage fields (dates, deadline status, directive, vendor and product labels, ransomware and forensic-triage flags), which keeps a full 200-CVE batch compact; full is the default

cisa_search_kev tool

• Filters AND together: vendorProject and product (CISA's own labels, not CPE names), nameContains, cwe, cveIdPrefix, dateAddedFrom / dateAddedTo, dueBefore / dueAfter, overdue, ransomware, forensicTriage, directive (BOD 26-04 / BOD 22-01 / none); up to 100 per page (default 25) with an opaque cursor; sorts by dateAdded (default) or dueDate
• Reports totalCount and appliedFilters; each continued page uses the current call's limit. A zero-hit result names the filter responsible and what dropping it restores. nameContains searches a-z and 0-9 after folding case and accents, and the notice names any other characters it dropped
• Typed errors: catalog_unavailable (retryable), invalid_date_range, empty_search_text

cisa_get_ssvc tool

• Processes up to 50 cveIds per call through the Vulnrichment cache, fetching uncached records; inputs up to 1,000 IDs return normalized unprocessedIds for a follow-up call. assetExposure: publicly_exposed, not_publicly_exposed, or unknown (default, returns both arms)
• Per CVE: found, exploitation, automatable, technicalImpact, cvss and cwes where CISA published them, and bod2604.timelines[] (tableRow, remediationTimelineDays, forensicTriageRequired); a KEV entry adds kevAssigned, plus assignmentAgrees when an exposure was stated
• Each result carries outcome: ssvc, not_found, no_cisa_container, no_ssvc_metric, or fetch_failed. foundCount, notFoundCount, and failedCount separate published SSVC, confirmed misses, and unavailable lookups; enrichment_source_unavailable (retryable) fires when every processed lookup fails

cisa_search_ics_advisories tool

• Full-text q over titles, vendor names, and product names, plus vendor, product (case-insensitive substrings), cve, cwe, inKev, cvssMin / cvssMax, severity, sector, series (ICSA / ICSMA), publisher (coordinator / other), publishedFrom / publishedTo, revisedFrom / revisedTo; sorts by revised (default), published, maxCvss, or relevance (needs q); up to 50 per page (default 20) with an opaque cursor
• Results carry advisoryId, up to 20 cves with cveCount, kevCves, maxCvss with severityDerived, sectors, url, csafUrl, and attribution, plus totalCount and appliedFilters; a zero-hit result names the filter responsible. If the KEV snapshot isn't loaded, kevCves is left out and says so
• Typed errors: mirror_not_ready, mirror_busy, and catalog_unavailable (retryable), mirror_unavailable, invalid_cvss_range, invalid_date_range, relevance_sort_without_query, empty_search_text

cisa_get_advisory tool

• advisoryId (optional revision suffix), optional sections (advisory, summary, products, vulnerabilities, revisionHistory, references, acknowledgments), cves to pick vulnerability entries, and productIds to pick exact, case-sensitive product definitions; cves and productIds imply their sections
• Returns kind: "full", or kind: "outline" (per-section byte sizes plus the CVE IDs) when a read without sections exceeds 24,000 bytes; re-call with sections. Both arms retain advisory identity, source links, and attribution
• Vulnerability entries retain applicability flags and threats; remediations, flags, and threats resolve referenced product groups into productIds and keep groupIds. Undefined groups remain visible without invented product definitions
• An ID not in the index returns found: false with guidance, indexCheckpoint, and indexLastSyncedAt; the guidance notes when the advisory may be newer than the index
• Typed errors: mirror_not_ready and mirror_busy (retryable), mirror_unavailable, unknown_section, unknown_cve, cves_need_vulnerabilities_section, unknown_product_id, product_ids_need_products_section

cisa_get_alerts tool

• feed: advisories (default), alerts, or ics; default limit 30, the upstream window size; since (YYYY-MM-DD) filters within that window and cannot reach past it. hasMore and an opaque cursor continue after the last returned item within the same feed; an unavailable anchor returns an empty page with restart guidance
• Items carry title, link, pubDate, summary (HTML stripped, capped at 1,200 characters, flagged by summaryTruncated), and on ICS items an advisoryId for cisa_get_advisory; window reports itemCount, oldest, newest, and upstreamWindowSize
• Every response carries fetchedAt and stale; if a refresh fails, the last window is returned as stale with retry guidance, and a stale empty result doesn't prove nothing was published. With no cached window, feed_unavailable (retryable)

cisa://kev/{cveId} resource

• One KEV record as application/json, the same shape as a cisa_check_cve_status result under the default detail: "full"; a CVE not in KEV is a not-found error
• Listing returns the 30 most recently added entries; cveId completes from the snapshot, up to 100 suggestions

cisa://advisory/{advisoryId} resource

• One flattened advisory as application/json, with the same 24,000-byte outline-on-overflow as cisa_get_advisory; the template takes no sections, cves, or productIds, so follow an outline up with the tool
• Listing returns the 30 most recently revised advisories; advisoryId completes from the index, up to 100 suggestions

Features

Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.

CISA-specific:

• Four public sources, no account or key: the KEV JSON feed, Vulnrich