vuln-intel

io.github.rozetyp/vuln-intel · v1.0.2

Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports

MCPremoteAPI keySecurityE-commerce

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 12 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 79/100

What it does: 12 tools · 12 read, 0 write · Security, E-commerce, Developer tools

Test call search_vulns: needs a key: tool error: This vuln-intel tool needs a free API key. Get one in a minute at https://mcp.rozetyp.com/signup (sent by email, 60 requ (1,040 ms)

How the rating is made

Answers without login: +30
Speed of first answer: +10
Lists tools: +10
Tool descriptions: +15
Parameter descriptions: +1
Read/write annotations: +5
Safe test call: +8
More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL

https://mcp.rozetyp.com/mcp

Tools

12 tools listed at last check

enrich_cve Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with rationale, affected products/versions, and (live) public-exploit signal. Args: cve_id: e.g. "CVE-2025-12345". include_poc: also query Gi
check_technology Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron,
hunt_plan Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by real in-
observe Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS into a dig-order. Fetches o
search_vulns Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "SSO SAML assertion replay", "deserialization gadget chain", "server-side request forgery cloud metadata"). By default it
find_attack_approaches Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE. The "what approach worked on a bug like this, on which program, and what did it pay" layer: grounded in real pub
find_continuations When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the
assist_submission Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports: (1) precedent & validity — is this an accepted class, with citable reports (ammunition i
program_outcome_prior At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide what to look at first and what to skip. Built from real HackerOne disclosed reports: the class distribution for this program, each with LIFT over
verify_cve_claim Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the claimed product at the claimed version; is the severity right; is it actually KEV-exploited. Returns per-assertion verdicts (supported / refuted /
corpus_stats Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps).
search_public_code Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a distinctive line or symbol from the vulnerable function, then FETCH AND READ the hits to judge which copies are still unpatched,

Badge

Markdown for your README

[![Connect-MCP](https://clawy.uk/mcp/badge/io.github.rozetyp/vuln-intel.svg)](https://clawy.uk/mcp/s/io.github.rozetyp/vuln-intel)

Repository · Website