Live probe refreshed Oct 28, 2026 · Endpoint host mcp.mcpbundles.com
Connect Vulnerability Intelligence to any MCP client in minutes
https://mcp.mcpbundles.com/bundle/vulnerability-intelligenceThis server may ask you to sign in when your AI client connects.
Prefer the browser? Open in MCPBundles Studio
Sign in to connect your credentials and start running tools from the chat.
Connect to your AI clientMCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms
Add to your AI client, then sign in once when you connect.
Run Trivy on your machine via Desktop, enrich with NVD + CISA KEV + EPSS, and bucket container CVEs into exploit priority, patch today, and defer — with a reason on every row.
This listing identifies a third-party integration. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
https://mcp.mcpbundles.com/bundle/vulnerability-intelligenceThis server may ask you to sign in when your AI client connects.
Prefer the browser? Open in MCPBundles Studio
Choose your AI client below. When you connect, sign in to MCPBundles once — we store your service credentials for every client.
Browse all toolsBuilt for
Security Engineers, DevOps Teams, MSPs, Container Platform Owners
Scan node:20-slim (balanced)
Runs a local Trivy scan on a real Debian-based Node image and shows HIGH-tier fixes in patch_today.
Scan node:20-slim with policy_preset balanced. Summarize patch_today vs defer and explain one bucket_reason.
Python base — permissive patches
Contrasts policy presets on a slim API base — MEDIUM pip CVEs surface only under permissive_patches.
Scan python:3.13-slim with policy_preset permissive_patches. How many patch_today rows appear vs balanced?
Why is CRITICAL in defer?
Shows EPSS + fix-available gating — high CVSS does not auto-page.
Do I have to paste Trivy JSON?
No. With MCPBundles Desktop connected, pass `target` on `scan_triage` and Trivy runs on your machine. Paste JSON only when Desktop is offline.
What do exploit_priority, patch_today, and defer mean?
Exploit priority = CISA KEV or EPSS above your threshold. Patch today = vendor fix available and composite tier meets your policy minimum. Defer = everything else, including scary CVSS with low EPSS and no fix.
Why would a CRITICAL CVE land in defer?
Scanner severity is not the same as exploit likelihood. Old libc/tar rows often show CRITICAL CVSS with sub-5% EPSS and no vendor fix — the policy explains each defer with bucket_reason.
Domain knowledge for Vulnerability Intelligence — workflow patterns, data models, and gotchas for your AI agent.
Combines NIST NVD, CISA KEV, and FIRST.org EPSS into composite risk scores and container scan triage.
With MCPBundles Desktop connected and a Container Scan credential bound:
You can still paste Trivy/Grype JSON via scan_output when Desktop is unavailable.
Also listed on
Start here
Showing 32 of 34
Showing 32 of 34 tools from the public preview. Connect the server to inspect the full live tool list.
Compare Cvss Vs Composite
compare_cvss_vs_compositeCompare scanner CVSS ranking vs composite exploit-priority ranking for the same scan. Shows overlap and flipped priorities. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI.
Open in Studio[
{
"name": "compare_cvss_vs_composite",
"title": "Compare Cvss Vs Composite",
"description": "Compare scanner CVSS ranking vs composite exploit-priority ranking for the same scan. Shows overlap and flipped priorities. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "kev_landscape",
"title": "Kev Landscape",
"description": "CISA KEV catalog summary for the vulnerability intelligence workspace. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "manage_scans",
"title": "Manage Scans",
"description": "Manage persisted container scan triage history. Actions: list, get (by run_id or latest for target), compare (latest two runs for target), clear. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "manage_stack",
"title": "Manage Stack",
"description": "Manage your technology stack profile. The server remembers what you run and flags CVEs that affect your technologies in every response. Actions: add (comma-separated products), remove, list, clear. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "manage_watchlist",
"title": "Manage Watchlist",
"description": "Manage your CVE watchlist. The server tracks EPSS score changes and KEV status for watched CVEs and reports deltas in every lookup and briefing. Actions: add (captures baseline scores), remove, list, check (refresh live data), clear. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "scan_triage",
"title": "Scan Triage",
"description": "Triage container vulnerabilities. With a Container Scan credential and Desktop connected, pass target (image or filesystem) to run Trivy locally, then enrich with NVD + KEV + EPSS and bucket into exploit_priority / patch_today / defer with bucket_reason per row. Tune via policy_preset or epss_exploit_threshold / patch_today_min_tier. Alternatively pass scan_output JSON. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "security_briefing",
"title": "Security Briefing",
"description": "Security briefing — KEV catalog changes, watchlist deltas, stack exposure, and scan regression since your last briefing. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "vulnerability_analyze",
"title": "Vulnerability Analyze",
"description": "Full cross-source vulnerability analysis: NVD CVE details + EPSS exploit probability + CISA KEV status + composite risk score. Fetches all three sources in parallel and returns a unified risk assessment with tier (CRITICAL/HIGH/MEDIUM/LOW) and rationale. This is the primary combined tool for vulnerability intelligence. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
},
{
"name": "vulnerability_intelligence_open_app",
"title": "Vulnerability Intelligence Open App",
"description": "Open the Vulnerability Intelligence workspace. Use when the user asks to view the triage panel before running scan_triage, security_briefing, or KEV landscape. Use only when the user asks to open the panel before a specific data read. When the workspace panel is open, results update the panel automatically — do not call this tool again only to refresh the UI."
}
]No. With MCPBundles Desktop connected, pass `target` on `scan_triage` and Trivy runs on your machine. Paste JSON only when Desktop is offline.
Exploit priority = CISA KEV or EPSS above your threshold. Patch today = vendor fix available and composite tier meets your policy minimum. Defer = everything else, including scary CVSS with low EPSS and no fix.
© 2026 ThinkChain Inc. All rights reserved.
Capabilities
34 tools · 5 groups
23 read · 9 interactive
Previewing 32 of 34 tools
Scan python:3.13-slim and explain why notable_deferred_critical CVEs stayed in defer despite CRITICAL scanner severity.
Analyze one CVE
Single-CVE cross-source analysis for the regreSSHion case study.
Analyze CVE-2024-6387 across NVD, KEV, and EPSS and compare CVSS rank vs composite exploit priority.
Scanner severity is not the same as exploit likelihood. Old libc/tar rows often show CRITICAL CVSS with sub-5% EPSS and no vendor fix — the policy explains each defer with bucket_reason.
Balanced requires HIGH+ tier before patch_today when a fix exists. Permissive_patches lowers the bar to MEDIUM+, which surfaces pip/npm fixes on slim Python bases that balanced would defer.
Add the MCPBundles server URL to your MCP client configuration (Claude Desktop, Cursor, VS Code, etc.). The URL format is: https://mcp.mcpbundles.com/bundle/vulnerability-intelligence. Authentication is handled automatically.
Vulnerability Intelligence provides 34 tools that can be called by AI agents, along with a SKILL.md that gives your AI agent domain knowledge about when and how to use them.
Vulnerability Intelligence uses No auth required or API Key. Container Scan requires credentials. Connect via MCPBundles and authentication is handled automatically.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.
Other MCP servers in this category from the directory index