VulnMCP는 취약점 관리를 위한 도구로 AI 클라이언트, 채팅 에이전트 및 기타 자동화 시스템을 제공하는 FastMCP 서버입니다. 그것은 쉽게 확장하거나 통합 할 수있는 모듈 식 "skills"를 제공하며, 소프트웨어 취약점에 지능형 분석 및 자동화 된 통찰력을 가능하게합니다.

특징

• ** 취약점 분류 ** – CIRCL의 미세 조정 NLP 모델을 사용하여 취약점에 대한 자동 평가 : CIRCL/vulnerability-severity-classification-roberta-base (영어), CIRCL/vulnerability-severity-classification-chinese-macbert-base (중국어) 및 CIRCL/vulnerability-severity-classification-russian-ruRoberta-large (러시아어).
• CWE 분류 – CIRCL/cwe-parent-vulnerability-classification-roberta-base를 사용하여 취약점 설명에서 예측 CWE 카테고리.
• ATT&CK 기술 분류 – CIRCL/vulnerability-attack-technique-classification-roberta-base를 사용하여 취약점 묘사에서 취약점 기술, 훈련된 CVE-to-technique 매핑의 curated 금 세트에 VulnTrain.

VulnMCP

VulnMCP is an MCP server built with FastMCP that provides AI clients, chat agents, and other automated systems with tools for vulnerability management. It offers modular “skills” that can be easily extended or integrated, enabling intelligent analysis and automated insights on software vulnerabilities.

Features

• Vulnerability Severity Classification – Automatically assess the criticality of vulnerabilities using CIRCL’s fine-tuned NLP models: CIRCL/vulnerability-severity-classification-roberta-base (English), CIRCL/vulnerability-severity-classification-chinese-macbert-base (Chinese), and CIRCL/vulnerability-severity-classification-russian-ruRoberta-large (Russian).
• CWE Classification – Predict CWE categories from vulnerability descriptions using CIRCL/cwe-parent-vulnerability-classification-roberta-base.
• ATT&CK Technique Classification – Predict MITRE ATT&CK (Enterprise) techniques from vulnerability descriptions using CIRCL/vulnerability-attack-technique-classification-roberta-base, trained with VulnTrain on a curated gold set of CVE-to-technique mappings.
• Vulnerability Lookup – Query the Vulnerability Lookup API to get detailed information about specific CVEs, search vulnerabilities by source, CWE, product, or date, find community comments, and discover curated vulnerability bundles.
• KEV Catalog – Browse and filter Known Exploited Vulnerability (KEV) entries, check whether a CVE appears in a KEV catalog, find recently added entries, and filter by catalog origin (CISA KEV, CIRCL, EUVD KEV).
• GCVE Registry – Query the GCVE Global Numbering Authority (GNA) registry and references to discover vulnerability allocators and KEV catalog identifiers.
• CNA Partners – Search the CNA partners of the CVE Program (mirrored at gcve.eu) by name, country, role, or organization type, and retrieve a partner’s full record including disclosure policy and security advisory links.
• Modular Architecture – Easily add new skills or tools to expand the functionality of the MCP server.

Installation

Requires Python 3.10+ and Poetry v2+.

git clone https://github.com/vulnerability-lookup/VulnMCP.git
cd VulnMCP
poetry install