MCP server

Cisa Cybersecurity

io.github.cyanheads/cisa-cybersecurity-mcp-server

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

7

Token cost

About 5,397 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.cisa-cybersecurity-mcp-server]
url = "https://cisa-cybersecurity.caseyjhand.com/mcp"

Gemini CLI

{"mcpServers":{"cisa-cybersecurity-mcp-server":{"httpUrl":"https://cisa-cybersecurity.caseyjhand.com/mcp"}}}

Cursor

{"mcpServers":{"cisa-cybersecurity-mcp-server":{"url":"https://cisa-cybersecurity.caseyjhand.com/mcp"}}}

VS Code

{"servers":{"cisa-cybersecurity-mcp-server":{"type":"http","url":"https://cisa-cybersecurity.caseyjhand.com/mcp"}}}

Antigravity

agy mcp add cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"cisa-cybersecurity-mcp-server","server_url":"https://cisa-cybersecurity.caseyjhand.com/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"cisa-cybersecurity-mcp-server","server_url":"https://cisa-cybersecurity.caseyjhand.com/mcp"}

Tools

• cisa_check_cve_status ~654 tokens
  Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding ope
• cisa_get_advisory ~658 tokens
  Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sect
• cisa_get_alerts ~406 tokens
  List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on
• cisa_get_ssvc ~496 tokens
  Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you
• cisa_list_reference ~315 tokens
  Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells the
• cisa_search_ics_advisories ~1642 tokens
  Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publicatio
• cisa_search_kev ~1226 tokens
  Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage t

Browse

• GitHub tools
• GitHub and code hosting
• Security scanning
• Health and medicine

Related MCP servers

• ZEN SecDB
  ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.
• Outage.Me
  Live cloud/SaaS outages, provider reliability and exploited CVEs from official status pages and CISA
• Kevscope
  CVE patch-priority API + MCP: CISA KEV, EPSS, CVSS, SSVC. Keys $19/mo; 200 free calls/day.
• Cve Intelligence
  CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations.
• KEVWire
  Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.
• Kevscope CVE Check
  Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.
• TensorFeed
  AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.
• Circl Vulnerability Lookup
  CIRCL Vulnerability-Lookup — aggregated vulnerability records

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.cyanheads/cisa-cybersecurity-mcp-server.svg)](https://aptlynx.net/servers/io.github.cyanheads/cisa-cybersecurity-mcp-server)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents