Datakoot › Servers › Security Intel
Security · MCP Server

Security Intel

Three tools that let an AI agent check for known vulnerabilities before it trusts code: look up any CVE from the NVD, check a package against OSV, or audit a whole package.json in one call. No API key.

terminal
$ claude mcp add --transport http security-intel https://security.datakoot.com/mcp
Endpoint: security.datakoot.com/mcp3 toolsSources: NVD · OSVKeyless
The tools

Everything this server exposes.

The exact tools your agent sees, with their real parameters and the shape of what comes back. Descriptions are written for the model, so it knows when to call each one on its own.

cve_lookupSource: NVD (NIST)

Look up a CVE by ID and get a compact summary: description, CVSS score & severity, attack vector, CWE weakness class, publish date, and references.

Parameters
cve_idstringrequired
A CVE identifier, e.g. CVE-2021-44228.
cve_lookup("CVE-2021-44228")
{
  "id": "CVE-2021-44228",
  "severity": "CRITICAL",
  "cvss": 10.0,
  "vector": "AV:N/AC:L/PR:N/UI:N/...",
  "cwe": "CWE-502",
  "published": "2021-12-10",
  "summary": "Apache Log4j2 JNDI (Log4Shell)",
  "references": 8
}
package_vulnerabilitiesSource: OSV.dev

List known vulnerabilities for a package — optionally pinned to one version. Covers npm, PyPI, cargo, Go, Maven, RubyGems, NuGet, Composer, pub and hex.

Parameters
ecosystemstringrequired
One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.
namestringrequired
The package name, e.g. lodash.
versionstringoptional
If given, only vulnerabilities affecting that version are returned.
package_vulnerabilities("npm","lodash","4.17.20")
{
  "package": "lodash",
  "ecosystem": "npm",
  "version": "4.17.20",
  "vulnerabilities": [{
    "id": "CVE-2021-23337",
    "severity": "HIGH",
    "summary": "Command injection via template",
    "fixed": "4.17.21"
  }]
}
audit_dependenciesSource: OSV.dev

Audit a whole dependency manifest in one call. Paste a raw package.json, or pass a list of {name, version} objects. Returns per-package findings plus a summary count.

Parameters
manifeststringoptional
Raw package.json contents.
dependenciesarrayoptional
An array of {name, version} entries, as an alternative to a manifest.
ecosystemstringoptional
Defaults to npm.
audit_dependencies(manifest: package.json)
{
  "ecosystem": "npm",
  "checked": 42,
  "vulnerable": 2,
  "findings": [
    { "name": "lodash",
      "version": "4.17.20",
      "vulns": ["CVE-2021-23337"] },
    { "name": "axios",
      "version": "0.21.0",
      "vulns": ["CVE-2021-3749"] }
  ]
}
Data sources

Two authorities. Nothing scraped.

Every answer traces back to a source a security team would already cite — read live, so a CVE published today is available today.

NVD — National Vulnerability Database

NIST's canonical CVE feed. Powers cve_lookup — descriptions, CVSS scores, vectors and CWE classes straight from the source of record.

OSV.dev — Open Source Vulnerabilities

Google's per-ecosystem advisory database. Powers package_vulnerabilities and audit_dependencies with version-precise findings across ten ecosystems.

Connect it

One line, any MCP client.

Same endpoint everywhere. No account, no key, no config file.

Claude
claude mcp add --transport http security-intel https://security.datakoot.com/mcp
Cursor
Settings → MCP → Add → https://security.datakoot.com/mcp
Windsurf
Add MCP server → https://security.datakoot.com/mcp
Companion extension

Prefer to look it up yourself?

The matching Chrome extension puts the same NVD data in your browser — no agent required.

CVE Lookup

Type a CVE ID and get the severity, CVSS score, summary and references instantly — the exact same NVD data as cve_lookup. Free, keyless, no signup.

Get the extension →
Security Intel — FAQ

Questions about this server

It reads live from the NVD and OSV, so a CVE or advisory published today is available today — not whenever a model was last trained. Responses are lightly cached for speed.

Ten, via OSV: npm, PyPI, cargo, Go, Maven, RubyGems, NuGet, Composer, pub and hex. Pass the ecosystem and name and it resolves the advisories.

No. Datakoot handles the upstream calls and caching, so you connect with one keyless line. There's no key to request, store, or leak.

Yes — paste a full package.json into audit_dependencies and it batch-checks every entry in one call, returning only the packages with known CVEs.

Connect it and let your agent check.

Free to start. One line. No key to leak.

Start freeBack to all servers