Search / io.github.cyanheads/cisa-cybersecurity-mcp-server
protogridR0· no sign-inCISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.
v0.3.2 · active · repository · descriptor JSON · versions
{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"type": "http",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp[mcp_servers.cisa-cybersecurity-mcp-server]
url = "https://cisa-cybersecurity.caseyjhand.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cisa-cybersecurity-mcp-server": {
"type": "remote",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"type": "http",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=cisa-cybersecurity-mcp-server&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vY2lzYS1jeWJlcnNlY3VyaXR5LmNhc2V5amhhbmQuY29tL21jcCJ9"
}{
"servers": {
"cisa-cybersecurity-mcp-server": {
"type": "http",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"httpUrl": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}extensions:
"cisa-cybersecurity-mcp-server":
enabled: true
name: "cisa-cybersecurity-mcp-server"
type: streamable_http
uri: "https://cisa-cybersecurity.caseyjhand.com/mcp"
timeout: 300
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every useauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_length1 tools have descriptions over 1,024 characters, which crowds the contexttools.schemasevery tool has an object input schematools.annotations7 of 7 tools declare readOnlyHint or destructiveHinttools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: cisa_check_cve_status (destructiveHint, openWorldHint); cisa_get_ssvc (destructiveHint, openWorldHint); cisa_get_alerts (destructiveHint, openWorldHint); …tools.token_costabout 4,735 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes11 tool changes in 30 daysstability.rug_pull1 tools kept their name but changed most of their description in 30 days; review before trusting themdeps.known_vulnsno known advisory in 96 resolved packagesdeps.mcp_sdk_version@modelcontextprotocol/core 2.3.1, no known advisorydeps.resolvable@cyanheads/[email protected], @cyanheads/[email protected] resolved: 96 packagescisa_get_alertschangedinput schema, output schemacisa_get_advisorychangeddescription, input schema, output schemameaning changedRead one CISA industrial control system advisory in full: affected products flattened from the CSAF product tree into vendor, product, and version ranges; per-CVE CVSS score, vector, and CWE; remediations with their category and vendor instructions; critical-infrastructure sectors; and the revision history. Large advisories return a section outline instead of the whole document, listing each section's size and the CVE IDs the vulnerabilities section holds — re-call with the sections you need, or with cves to read only those vulnerability entries. Republished vendor advisories carry the originating vendor's text; every response reports the source URL and attribution. Find advisory IDs with cisa_search_ics_advisories.
Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, or remediations. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.
cisa_search_ics_advisorieschangedinput schema, output schemacisa_search_kevchangedinput schemacisa_list_referencechangedoutput schemacisa_get_alertschangedoutput schemacisa_get_advisorychangedinput schema, output schemacisa_search_ics_advisorieschangeddescription, input schema, output schemaSearch the CISA industrial control system advisory corpus — 3,926 CSAF 2.0 documents covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.
Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.
cisa_search_kevchangedinput schema, output schemacisa_check_cve_statuschangeddescription, input schema, output schemaCheck CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
Showing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +reachable +uptime-100% +updated-6d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
@cyanheads/[email protected] npm47 dependencies, resolved · MCP SDK @modelcontextprotocol/core 2.3.1 · advisories checked 2026-10-19
No known advisory affects this dependency graph.
@cyanheads/[email protected] npm47 dependencies, resolved · MCP SDK @modelcontextprotocol/core 2.3.1 · advisories checked 2026-10-19
No known advisory affects this dependency graph.
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://cisa-cybersecurity.caseyjhand.com/mcp streamable-http | none | yes | 100% | 202 ms | 2026-07-28 | 2026-10-20 |
| package | registry | version | runtime | secrets |
|---|---|---|---|---|
@cyanheads/cisa-cybersecurity-mcp-server | npm | 0.3.2 | npx | |
@cyanheads/cisa-cybersecurity-mcp-server | npm | 0.3.2 | npx |
cisa_check_cve_statusread-only | Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE. |
cisa_get_advisoryread-only | Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, or remediations. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories. |
cisa_get_alertsread-only | List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010. |
cisa_get_ssvcread-only | Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary. |
cisa_list_referenceread-only | Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here. |
cisa_search_ics_advisoriesread-only | Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries. |
cisa_search_kevread-only | Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed. |
Schemas: list_tools.
And 140 more from this publisher.
{
"name": "io.github.cyanheads/cisa-cybersecurity-mcp-server",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp",
"type": "streamable-http"
}
],
"version": "0.3.2",
"packages": [
{
"version": "0.3.2",
"transport": {
"type": "stdio"
},
"identifier": "@cyanheads/cisa-cybersecurity-mcp-server",
"runtimeHint": "npx",
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"environmentVariables": [
{
"name": "MCP_LOG_LEVEL",
"format": "string",
"default": "info",
"description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
},
{
"name": "CISA_KEV_REFRESH_CRON",
"format": "string",
"default": "*/30 * * * *",
"description": "Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup."
},
{
"name": "CISA_CSAF_MIRROR_PATH",
"format": "string",
"description": "Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows."
},
{
"name": "CISA_CSAF_MIRROR_AUTO_INIT",
"format": "string",
"default": "true",
"description": "Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band."
},
{
"name": "CISA_CSAF_REFRESH_CRON",
"format": "string",
"default": "17 */6 * * *",
"description": "Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup."
},
{
"name": "CISA_VULNRICHMENT_CACHE_TTL_SECONDS",
"format": "string",
"default": "21600",
"description": "Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value."
},
{
"name": "CISA_FEED_CACHE_TTL_SECONDS",
"format": "string",
"default": "900",
"description": "Seconds a parsed RSS feed window stays cached."
},
{
"name": "CISA_HTTP_TIMEOUT_MS",
"format": "string",
"default": "30000",
"description": "Per-request timeout in milliseconds for every upstream fetch."
}
]
},
{
"version": "0.3.2",
"transport": {
"url": "http://localhost:3010/mcp",
"type": "streamable-http"
},
"identifier": "@cyanheads/cisa-cybersecurity-mcp-server",
"runtimeHint": "npx",
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"environmentVariables": [
{
"name": "MCP_TRANSPORT_TYPE",
"value": "http",
"format": "string",
"description": "Selects the HTTP transport."
},
{
"name": "MCP_HTTP_HOST",
"format": "string",
"default": "127.0.0.1",
"description": "The hostname for the HTTP server."
},
{
"name": "MCP_HTTP_PORT",
"format": "string",
"default": "3010",
"description": "The port to run the HTTP server on."
},
{
"name": "MCP_HTTP_ENDPOINT_PATH",
"format": "string",
"default": "/mcp",
"description": "The endpoint path for the MCP server."
},
{
"name": "MCP_AUTH_MODE",
"format": "string",
"default": "none",
"description": "Authentication mode to use: 'none', 'jwt', or 'oauth'."
},
{
"name": "MCP_LOG_LEVEL",
"format": "string",
"default": "info",
"description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
},
{
"name": "CISA_KEV_REFRESH_CRON",
"format": "string",
"default": "*/30 * * * *",
"description": "Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup."
},
{
"name": "CISA_CSAF_MIRROR_PATH",
"format": "string",
"description": "Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows."
},
{
"name": "CISA_CSAF_MIRROR_AUTO_INIT",
"format": "string",
"default": "true",
"description": "Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band."
},
{
"name": "CISA_CSAF_REFRESH_CRON",
"format": "string",
"default": "17 */6 * * *",
"description": "Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup."
},
{
"name": "CISA_VULNRICHMENT_CACHE_TTL_SECONDS",
"format": "string",
"default": "21600",
"description": "Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value."
},
{
"name": "CISA_FEED_CACHE_TTL_SECONDS",
"format": "string",
"default": "900",
"description": "Seconds a parsed RSS feed window stays cached."
},
{
"name": "CISA_HTTP_TIMEOUT_MS",
"format": "string",
"default": "30000",
"description": "Per-request timeout in milliseconds for every upstream fetch."
}
]
}
],
"repository": {
"url": "https://github.com/cyanheads/cisa-cybersecurity-mcp-server",
"source": "github"
},
"description": "CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless."
}