io.github.cyanheads/cisa-cybersecurity-mcp-server

io.github.cyanheads/cisa-cybersecurity-mcp-server · v0.3.2

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

MCPremotelocal · npmno credentialsSecurityE-commerce

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 7 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

A 100/100

What it does: 7 tools · 7 read, 0 write · Security, E-commerce, Knowledge & docs

Test call cisa_search_kev: worked (1,035 ms)

How the rating is made

Answers without login: +30
Speed of first answer: +10
Lists tools: +10
Tool descriptions: +15
Parameter descriptions: +10
Read/write annotations: +5
Safe test call: +20
More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL

https://cisa-cybersecurity.caseyjhand.com/mcp

Package

registry:   npm
identifier: @cyanheads/cisa-cybersecurity-mcp-server
version:    0.3.2
transport:  stdio

Tools

7 tools listed at last check

cisa_list_reference Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells the
cisa_check_cve_status Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding ope
cisa_search_kev Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage t
cisa_get_ssvc Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you
cisa_search_ics_advisories Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publicatio
cisa_get_advisory Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sect
cisa_get_alerts List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on

Badge

Markdown for your README

[![Connect-MCP](https://clawy.uk/mcp/badge/io.github.cyanheads/cisa-cybersecurity-mcp-server.svg)](https://clawy.uk/mcp/s/io.github.cyanheads/cisa-cybersecurity-mcp-server)

Repository