VulnMCPは、AIクライアント、チャットエージェント、およびその他の自動システムに脆弱性管理のためのツールを提供するFastMCPが組み込まれたMCPサーバーです。 簡単に拡張または統合できるモジュラー「スキル」を提供し、インテリジェントな分析とソフトウェアの脆弱性に関する自動インサイトを有効にします。

##特徴

*脆弱性の重度分類 – CIRCL の微調整された NLP モデルを使用して脆弱性のクリティリティを自動的に評価します。 CIRCL/vulnerability-severity-classification-roberta-base (英語), CIRCL/vulnerability-severity-classification-chinese-macbert-base (中国語), CIRCL/vulnerability-severity-classification-russian-ruRoberta-large (ロシア語). *CWE の分類 – CIRCL/cwe-parent-vulnerability-classification-roberta-base を使用して脆弱性の説明から CWE のカテゴリを予測します。 *ATT&CKテクニックの分類 - CIRCL /脆弱性-attack-technique-classification-roberta-baseを使用して脆弱性の説明からMITRE ATT&CK(エンタープライズ)テクニックを予測し、CVE-to-techniqueマッピングのキュレーションされたゴールドセットでVulnTrainで訓練.

VulnMCP

VulnMCP is an MCP server built with FastMCP that provides AI clients, chat agents, and other automated systems with tools for vulnerability management. It offers modular “skills” that can be easily extended or integrated, enabling intelligent analysis and automated insights on software vulnerabilities.

Features

• Vulnerability Severity Classification – Automatically assess the criticality of vulnerabilities using CIRCL’s fine-tuned NLP models: CIRCL/vulnerability-severity-classification-roberta-base (English), CIRCL/vulnerability-severity-classification-chinese-macbert-base (Chinese), and CIRCL/vulnerability-severity-classification-russian-ruRoberta-large (Russian).
• CWE Classification – Predict CWE categories from vulnerability descriptions using CIRCL/cwe-parent-vulnerability-classification-roberta-base.
• ATT&CK Technique Classification – Predict MITRE ATT&CK (Enterprise) techniques from vulnerability descriptions using CIRCL/vulnerability-attack-technique-classification-roberta-base, trained with VulnTrain on a curated gold set of CVE-to-technique mappings.
• Vulnerability Lookup – Query the Vulnerability Lookup API to get detailed information about specific CVEs, search vulnerabilities by source, CWE, product, or date, find community comments, and discover curated vulnerability bundles.
• KEV Catalog – Browse and filter Known Exploited Vulnerability (KEV) entries, check whether a CVE appears in a KEV catalog, find recently added entries, and filter by catalog origin (CISA KEV, CIRCL, EUVD KEV).
• GCVE Registry – Query the GCVE Global Numbering Authority (GNA) registry and references to discover vulnerability allocators and KEV catalog identifiers.
• CNA Partners – Search the CNA partners of the CVE Program (mirrored at gcve.eu) by name, country, role, or organization type, and retrieve a partner’s full record including disclosure policy and security advisory links.
• Modular Architecture – Easily add new skills or tools to expand the functionality of the MCP server.

Installation

Requires Python 3.10+ and Poetry v2+.

git clone https://github.com/vulnerability-lookup/VulnMCP.git
cd VulnMCP
poetry install