CVE intelligence for your AI assistant
Search more than 424,000 CVE records, read affected software and version evidence, and check known exploitation and dated risk scores. Each result keeps its source references.
Connect
Add this remote MCP connector to a client that supports Streamable HTTP. The CVE tools are public and read-only. No account or API key is required.
https://excessionlabs.ai/mcp/cveThe main Excession Labs MCP endpoint at https://excessionlabs.ai/mcp includes the same CVE tools plus site search and contact information. Its separate request_security_test action needs an agent key and the person's consent.
Ask about recent vulnerabilities
- “Show newly published CVEs affecting Python or Linux, with source version information.”
- “Find actively exploited vulnerabilities in this product and show the vendor references.”
- “Read this CVE's affected-version assertions, then show what is unknown about applicability.”
- “Show new and changed records since this change-feed cursor.”
Tools
| Tool | What it returns |
|---|---|
cve_search | Search by text, vendor, product, package, ecosystem or literal source version. Sort by exploitation priority, recent modification or publication date. |
cve_get | Source evidence, severity, KEV and EPSS, with pages of affected-software and version assertions. |
cve_history | Revisions retained after the hosted database's history start date. |
cve_status | Record counts, collection freshness, errors and incomplete source coverage. |
cve_sources | Source attribution, collection methods and coverage limits. |
cve_changes | New and changed records after a sequence cursor. |
Coverage and updates
The baseline comes from the CVE Program's CVE List. Other evidence comes from NVD, CISA KEV, FIRST EPSS and GitHub Security Advisories. Hosted scheduled collection adds new records and updates existing ones. Call cve_status for the current checkpoint and any source backlog.
The hosted worker runs every ten minutes and processes bounded batches. Source schedules differ, and catch-up can take several runs. EPSS refresh rotates through recent and KEV-listed CVEs; the remaining scores keep their original snapshot dates. Imported OSV and vendor evidence may have older or incomplete coverage.
Coverage differs by source. The database does not contain every advisory on every website, and some records lack usable version information. A literal software/version match is source evidence, not a finding that your installed system is vulnerable. Version ranges are returned as published and are not automatically evaluated.
CISA KEV lists vulnerabilities known to have been exploited. Absence from that catalog does not establish that a CVE is unexploited. FIRST EPSS estimates exploitation probability over the next 30 days; it is not confirmation of exploitation. Both should be read with their observation dates.
Large affected-software lists are paginated. Follow the returned cursor before treating a result as complete. Hosted revision history starts at the displayed cutover date and is not a complete archive of earlier source revisions.
Hosted revisions retain normalized source evidence. A version claim with a group_id inherits shared product evidence from that revision's affected_groups. Initial hosted observations establish the monitoring baseline; they do not necessarily mean the upstream advisory changed.
This product uses the NVD API but is not endorsed or certified by the NVD.
Privacy and support
The connector reads public vulnerability data. It does not inspect your devices or upload a software inventory. Avoid putting credentials or private customer information in queries. See the privacy policy and terms.
Contact support@excessionlabs.ai for help. Connector configuration and examples are also in the public MCP documentation repository.