selflabbs-security-intelSAFE
Vulnerability-intelligence MCP server for AI agents: CVE lookups (NVD) and dependency-manifest audits (OSV). Keyless.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Vulnerability intelligence for AI agents — as MCP tools your agent can call mid-task. One keyless call fuses NVD, CISA KEV and FIRST EPSS. No API keys.
Tools
No API keys required for any tool.
Quick start
claude mcp add --transport http security-intel https://security.datakoot.com/mcp
Or point any MCP client at https://security.datakoot.com/mcp.
Try it in 10 seconds — no key, no signup
Paste this into a terminal:
curl -s https://security.datakoot.com/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "cve_lookup", "arguments": {"cve_id": "CVE-2021-44228"}}}'You get Log4Shell (CVE-2021-44228) in one answer: the NVD record (severity, CVSS vector, references), its CISA KEV entry (exploited in the wild, used in ransomware) and its EPSS exploit probability. No API key, nothing to sign up for.
Or point any MCP client at the URL and just ask your agent, in plain language:
- "Is CVE-2021-44228 something I need to worry about?"
- "Which of these CVEs is actually being exploited right now?"
- "Audit my package.json for known vulnerabili
44e2f3fe06abOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add security-intel-mcp -- npx -y security-intel-mcp
{
"mcpServers": {
"security-intel-mcp": {
"command": "npx",
"args": [
"-y",
"security-intel-mcp"
]
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
audit_dependencies | read | Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as |
cve_lookup | read | Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS. |
epss_score | read | Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS. |
package_vulnerabilities | read | List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
streamable-http
Gates applied: no_behavioural_pass.
44e2f3fe06abfull audit observations/trust-audit/mcp-server/datakoot__security-intel-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 44e2f3fe06ab | SAFE | B | 89 | first audit |
Questions
What is the selflabbs-security-intel MCP server?
Vulnerability-intelligence MCP server for AI agents: CVE lookups (NVD) and dependency-manifest audits (OSV). Keyless.
What tools does selflabbs-security-intel expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is selflabbs-security-intel safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does selflabbs-security-intel need?
No credential environment variables were found in its source, so it appears to need none.
How does selflabbs-security-intel run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as security-intel-mcp.
How current is this page?
The grade is for one exact copy of the source (44e2f3fe06ab), read on 2026-10-11. The repository is watched and re-audited when it changes.