NVD, EPSS, CISA KEV, GitHub Advisory, OSV, Shodan, VulnCheck, Vulners, Nuclei, Metasploit, CIRCL, AttackerKB va MITRE ATT&CK — hop nhat trong mot MCP server duy nhat.
AI agent cua ban nhan duoc thong tin tinh bao lo hong theo yeu cau, khong phai bao cao 200 trang.
---
## Van De
Thong tin tinh bao lo hong bi phan tan tren nhieu co so du lieu. NVD co chi tiet CVE. EPSS cho ban biet xac suat khai thac. CISA KEV theo doi cac lo hong dang bi khai thac. GitHub Advisory bao phu cac goi ma nguon mo. OSV anh xa lo hong den cac phien ban goi cu the. Shodan theo doi su pho bien tren internet. Nuclei va Metasploit cho ban biet co exploit hoat dong hay khong. Khong co cong cu nao tong hop tat ca, va khong co cong cu nao hoat dong voi AI agent.
```
Quy trinh truyen thong:
tim kiem NVD de lay chi tiet CVE → dieu huong giao dien Web UI phuc tap
kiem tra EPSS de danh gia rui ro khai thac → API rieng, dinh dang rieng
tra cuu trang thai CISA KEV → tai xuong JSON feed thu cong
tim kiem GitHub advisories → lai them mot giao dien nua
truy van OSV de biet anh huong goi → API khac, schema khac
kiem tra Shodan de biet su pho bien → dang ky rieng
tim Nuclei/MSF exploits → tim kiem GitHub thu cong
anh xa den ATT&CK techniques → tra cuu MITRE rieng
tuong quan moi thu → sao chep-dan vao bang tinh
──────────────────────────────────
Tong cong: 30+ phut cho moi CVE, lau hon cho phan loai hang loat
```
**cve-mcp** cung cap cho AI agent cua ban 41 cong cu qua [Model Context Protocol](https://modelcontextprotocol.io). Agent truy van 11 nguon song song, tuong quan du lieu, phat hien tin hieu vu khi hoa, tinh diem rui ro va cho ban biet chinh xac dieu gi quan trong.
```
Voi cve-mcp:
Ban: "Uu tien 10 CVE nay theo rui ro khai thac thuc te"
Agent: → lay diem CVSS tu NVD
→ lay xac suat khai thac EPSS cho tung CVE
→ kiem tra CISA KEV cho cac lo hong dang bi khai thac
→ doi chieu cheo GitHub advisories cho ban va
→ "3 lo hong nghiem trong: CVE-2024-3400 (EPSS 97%, trong KEV),
CVE-2023-44487 (HTTP/2 rapid reset, EPSS 96%),
CVE-2021-44228 (Log4Shell, EPSS 97%, trong KEV).
Day la ban va va cac phien ban bi anh huong..."
```
---
## Khac Biet Nhu The Nao
Cac cong cu hien co cho ban du lieu tho. cve-mcp cho AI agent cua ban kha nang phan tich lo hong.
Chi CVSS (muc do nghiem trong, khong phai kha nang khai thac)
CVSS × EPSS × KEV × He so nhan Exploit (Nuclei/MSF) = rui ro thuc te
Tuong quan
Sao chep-dan thu cong
Agent lam giau: "CVSS 9.8, EPSS 97%, trong KEV, co Nuclei template, co MSF module, anh xa den T1190"
Phan loai hang loat
Moi lan mot CVE
Agent uu tien 50 CVE trong mot cuoc hoi thoai
Anh huong goi
Tra cuu OSV/GHSA rieng
Agent tu dong tim cac goi va phien ban bi anh huong
Phu thuoc
Cong cu CLI nang, moi truong Python
2 runtime dependencies, chay voi npx
---
## Bat Dau Nhanh
### Tuy chon 1: npx (khong can cai dat)
```bash
npx cve-mcp
```
### Tuy chon 2: Clone
```bash
git clone https://github.com/badchars/cve-mcp.git
cd cve-mcp
bun install
```
### Bien moi truong (tuy chon)
```bash
# Tang rate limit NVD tu 5 len 50 yeu cau moi 30 giay
export NVD_API_KEY=your-nvd-api-key
# Kich hoat tim kiem GitHub Advisory (60 → 5000 yeu cau/gio)
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# VulnCheck extended KEV, CPE, PURL search
export VULNCHECK_API_KEY=your-vulncheck-key
# Vulners vulnerability search tren 200+ nguon
export VULNERS_API_KEY=your-vulners-key
# AttackerKB community assessments
export ATTACKERKB_API_KEY=your-attackerkb-key
```
Tat ca deu tuy chon. Server hoat dong ma khong can chung — chi voi rate limit thap hon hoac it du lieu hon.
### Ket noi voi AI agent cua ban
Claude Code
```bash
# Voi npx
claude mcp add cve-mcp -- npx cve-mcp
# Voi ban clone cuc bo
claude mcp add cve-mcp -- bun run /path/to/cve-mcp/src/index.ts
```
Claude Desktop
Them vao `~/Library/Application Support/Claude/claude_desktop_config.json`:
```json
{
"mcpServers": {
"cve-mcp": {
"command": "npx",
"args": ["cve-mcp"],
"env": {
"NVD_API_KEY": "optional-key",
"GITHUB_TOKEN": "optional-token",
"VULNCHECK_API_KEY": "optional-key",
"VULNERS_API_KEY": "optional-key",
"ATTACKERKB_API_KEY": "optional-key"
}
}
}
}
```
Cursor / Windsurf / cac MCP client khac
Cung dinh dang JSON config. Tro lenh den `npx cve-mcp` hoac duong dan cai dat cua ban.
### Bat dau truy van
```
Ban: "Ban biet gi ve CVE-2024-3400?"
```
Vay thoi. Agent se xu ly phan con lai.
---
## AI Co The Lam Gi
### Ung Pho Su Co
```
Ban: "Chung toi bi tan cong boi CVE-2024-3400. Cho toi moi thu."
Agent: → cve_enrich {cveId: "CVE-2024-3400"}
→ NVD: PAN-OS command injection, CVSS 10.0
→ EPSS: 97.2% xac suat khai thac
→ KEV: Them vao 2024-04-12, han chot 2024-05-01
→ Shodan: 4 CPEs, pho bien tren internet
→ Nuclei: Co detection template (nghiem trong)
→ Metasploit: Co exploit module (excellent rank)
→ "Nghiem trong. Da vu khi hoa — ca Nuclei va MSF modules deu co.
PAN-OS GlobalProtect, phien ban < 10.2.9-h1.
Va ngay lap tuc. Han chot CISA: 1 thang 5."
```
### Uu Tien Lo Hong
```
Ban: "Uu tien cac CVE tu ban quet: CVE-2021-44228, CVE-2024-3400,
CVE-2023-44487, CVE-2024-21762, CVE-2023-4966"
Agent: → cve_prioritize {cves: [...]}
→ Xep hang theo CVSS × EPSS × he so nhan KEV
→ "#1: CVE-2024-3400 (rui ro: 19.44, CVSS 10.0, EPSS 97%, KEV)
#2: CVE-2021-44228 (rui ro: 19.40, CVSS 10.0, EPSS 97%, KEV)
#3: CVE-2023-4966 (rui ro: 19.10, CVSS 9.4, EPSS 97%, KEV)
Ca 5 deu trong CISA KEV — va tat ca ngay lap tuc."
```
### Kiem Tra Phu Thuoc
```
Ban: "Kiem tra xem lodash 4.17.20 va django 3.2.0 co lo hong da biet khong"
Agent: → osv_batch {queries: [
{package: "lodash", version: "4.17.20", ecosystem: "npm"},
{package: "django", version: "3.2.0", ecosystem: "PyPI"}
]}
→ "lodash 4.17.20: 3 lo hong (prototype pollution)
django 3.2.0: 12 lo hong (SQL injection, XSS)
Nang cap lodash len 4.17.21+, django len 4.2+"
```
### Giam Sat Moi De Doa
```
Ban: "CVE nao co kha nang bi khai thac cao nhat hien tai?"
Agent: → cve_trending {limit: 10, minEpss: 0.9}
→ "Top 10 theo xac suat khai thac:
1. CVE-2024-3400 — PAN-OS (EPSS 97.2%, CVSS 10.0, KEV)
2. CVE-2023-44487 — HTTP/2 Rapid Reset (EPSS 96.5%, CVSS 7.5, KEV)
..."
```
### Phan Tich Sau CVSS (v3.1 & v4.0)
```
Ban: "Phan tich CVSS v4.0 vector nay: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
Agent: → cvss_parse {vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}
→ "CVSS v4.0 — Diem: 9.3 (NGHIEM TRONG)
Tan cong qua mang, do phuc tap thap, khong co yeu cau tan cong.
Khong can dac quyen, khong can tuong tac nguoi dung.
He thong de bi tan cong: anh huong day du C/I/A.
He thong tiep theo: khong anh huong."
```
### ATT&CK Mapping
```
Ban: "Anh xa CVE-2024-3400 den MITRE ATT&CK techniques"
Agent: → cve_to_attack {cweIds: ["CWE-77"]}
→ "CWE-77 (Command Injection) anh xa den:
T1059 — Command and Scripting Interpreter (Execution)
T1190 — Exploit Public-Facing Application (Initial Access)"
```
---
## Tham Chieu Cong Cu (41 cong cu)
NVD (4)
| Cong cu | Mo ta |
|------|-------------|
| `nvd_search` | Tim kiem CVE theo tu khoa, muc do nghiem trong, CWE, khoang thoi gian |
| `nvd_get` | Lay chi tiet CVE day du (CVSS, CWE, CPE, tham chieu) |
| `nvd_recent` | CVE duoc cong bo/sua doi gan day |
| `cve_by_product` | Tim CVE theo ten san pham (khop tu khoa CPE) |
EPSS (2)
| Cong cu | Mo ta |
|------|-------------|
| `epss_score` | Xac suat khai thac EPSS cho mot hoac nhieu CVE |
| `epss_top` | CVE hang dau theo xac suat khai thac |
KEV (3)
| Cong cu | Mo ta |
|------|-------------|
| `kev_check` | Kiem tra xem CVE co trong danh muc CISA Known Exploited Vulnerabilities khong |
| `kev_search` | Tim KEV theo nha cung cap, san pham hoac tu khoa |
| `kev_recent` | Muc KEV duoc them gan day |
GHSA (2)
| Cong cu | Mo ta |
|------|-------------|
| `ghsa_search` | Tim GitHub security advisories theo tu khoa, he sinh thai, muc do nghiem trong |
| `ghsa_get` | Lay chi tiet advisory theo GHSA ID hoac CVE ID |
OSV (3)
| Cong cu | Mo ta |
|------|-------------|
| `osv_query` | Truy van lo hong cho phien ban goi cu the |
| `osv_get` | Lay chi tiet lo hong theo OSV/GHSA/CVE ID |
| `osv_batch` | Truy van hang loat nhieu goi cung luc |
Exploit (1)
| Cong cu | Mo ta |
|------|-------------|
| `exploit_search` | Tim PoC exploit cong khai (GitHub repositories) |
Shodan (3)
| Cong cu | Mo ta |
|------|-------------|
| `shodan_cve` | Tra cuu CVE qua Shodan CVEDB (EPSS, KEV, CPE tich hop, khong can xac thuc) |
| `shodan_product` | Tim CVE theo ten san pham/nha cung cap qua Shodan |
| `shodan_ip_vulns` | Lay lo hong da biet cho mot IP address (InternetDB) |
VulnCheck (3)
| Cong cu | Mo ta |
|------|-------------|
| `vulncheck_kev` | Danh muc KEV mo rong (~80% nhieu muc hon CISA) |
| `vulncheck_cpe` | Tim CVE theo CPE string |
| `vulncheck_purl` | Tim CVE theo Package URL (purl) |
Vulners (2)
| Cong cu | Mo ta |
|------|-------------|
| `vulners_lookup` | Chi tiet CVE tu Vulners (200+ nguon, exploit refs) |
| `vulners_search` | Tim kiem lo hong full-text tren co so du lieu Vulners |
Nuclei & Metasploit (2)
| Cong cu | Mo ta |
|------|-------------|
| `nuclei_check` | Kiem tra xem co Nuclei detection template cho CVE khong |
| `msf_check` | Kiem tra xem co Metasploit exploit module cho CVE khong |
CPE (2)
| Cong cu | Mo ta |
|------|-------------|
| `cpe_search` | Tim tu dien NVD CPE theo tu khoa |
| `cpe_match` | Lay CPE matches cho mot CVE cu the |
CIRCL (1)
| Cong cu | Mo ta |
|------|-------------|
| `circl_cve` | CIRCL CVE enrichment (CAPEC, tham chieu thay the, impact vectors) |
AttackerKB (1)
| Cong cu | Mo ta |
|------|-------------|
| `attackerkb_assess` | Danh gia cong dong tu AttackerKB (attacker value, exploitability) |
ATT&CK (1)
| Cong cu | Mo ta |
|------|-------------|
| `cve_to_attack` | Anh xa CVE CWE IDs den MITRE ATT&CK techniques va tactics |
CWE (4)
| Cong cu | Mo ta |
|------|-------------|
| `cwe_lookup` | Tra cuu diem yeu CWE theo ID hoac tim theo tu khoa (DB tinh) |
| `cwe_get` | Chi tiet CWE day du tu MITRE API (1000+ CWEs, giam thieu, vi du) |
| `cwe_hierarchy` | Phan cap CWE parent/child tu MITRE API |
| `cwe_top25` | MITRE CWE Top 25 Most Dangerous Software Weaknesses |
CVSS (1)
| Cong cu | Mo ta |
|------|-------------|
| `cvss_parse` | Phan tich va giai thich chuoi vector CVSS v3.1 hoac v4.0 voi tinh diem |
Meta (6)
| Cong cu | Mo ta |
|------|-------------|
| `cve_enrich` | Lam giau day du: NVD + EPSS + KEV + GHSA + OSV + Shodan + Nuclei + MSF song song |
| `cve_prioritize` | Xep hang CVE theo rui ro (CVSS × EPSS × KEV × He so nhan Exploit) |
| `cve_trending` | CVE dang trending theo xac suat khai thac |
| `cve_compare` | So sanh hai CVE canh nhau |
| `cve_list_sources` | Liet ke tat ca 11 nguon du lieu va tinh trang kha dung |
| `cve_report` | Tao bao cao lo hong dang markdown |
---
## Nguon Du Lieu
| Nguon | Xac thuc | Cung cap gi |
|--------|------|-----------------|
| [NVD](https://nvd.nist.gov/) | `NVD_API_KEY` tuy chon | Chi tiet CVE, diem CVSS, anh xa CWE, san pham bi anh huong CPE, tham chieu |
| [EPSS](https://www.first.org/epss/) | Khong | Diem xac suat khai thac (0-1) va xep hang phan vi |
| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Khong | Lo hong da biet dang bi khai thac voi han chot khac phuc |
| [GitHub Advisory](https://github.com/advisories) | `GITHUB_TOKEN` tuy chon | Advisory bao mat ma nguon mo, goi bi anh huong, muc do nghiem trong |
| [OSV](https://osv.dev/) | Khong | Du lieu lo hong cap goi tren 16+ he sinh thai |
| [Shodan CVEDB](https://cvedb.shodan.io/) | Khong | Tra cuu CVE voi EPSS/KEV/CPE tich hop, quet lo hong IP |
| [VulnCheck](https://vulncheck.com/) | `VULNCHECK_API_KEY` tuy chon | KEV mo rong (~80% nhieu hon CISA), tim kiem lo hong CPE/PURL |
| [Vulners](https://vulners.com/) | `VULNERS_API_KEY` tuy chon | Tim kiem lo hong tren 200+ nguon, tham chieu exploit |
| [Nuclei Templates](https://github.com/projectdiscovery/nuclei-templates) | Khong | Kiem tra su ton tai cua CVE detection template (muc do nghiem trong, tags) |
| [Metasploit](https://github.com/rapid7/metasploit-framework) | Khong | Kiem tra su ton tai cua exploit module (loai, rank, path) |
| [CIRCL](https://cve.circl.lu/) | Khong | CVE enrichment voi CAPEC mapping, tham chieu thay the, impact vectors |
| [AttackerKB](https://attackerkb.com/) | `ATTACKERKB_API_KEY` tuy chon | Danh gia cong dong (attacker value, exploitability ratings) |
| [MITRE ATT&CK](https://attack.mitre.org/) | Khong | Anh xa CWE-to-ATT&CK technique (tactics, techniques) |
| [MITRE CWE](https://cwe-api.mitre.org/) | Khong | Co so du lieu CWE day du (1000+ diem yeu, phan cap, giam thieu) |
### Cong Thuc Diem Rui Ro
```
Diem Rui Ro = Diem Co So CVSS × Diem EPSS × He So Nhan KEV × He So Nhan Exploit
Trong do:
Diem Co So CVSS = 0-10 (muc do nghiem trong tu NVD)
Diem EPSS = 0-1 (xac suat khai thac tu FIRST)
He So Nhan KEV = 2 neu trong CISA KEV, 1 neu khong
He So Nhan Exploit = 1.5 neu co Nuclei template HOAC Metasploit module, 1 neu khong
```
Cong thuc nay cho diem rui ro thuc te can bang giua muc do nghiem trong (CVSS) voi kha nang khai thac thuc te (EPSS), khai thac dang hoat dong da biet (KEV) va tin hieu vu khi hoa (cong cu exploit cong khai).
---
## Kien Truc
```
src/
├── index.ts Diem vao + MCP stdio
├── types/
│ └── index.ts ToolDef, ToolContext, ToolResult, kieu API
├── protocol/
│ ├── tools.ts 41 dinh nghia cong cu (Zod schemas)
│ └── mcp-server.ts MCP server + stdio transport
├── nvd/
│ ├── index.ts NVD API v2 — search, get, recent
│ └── cpe.ts Tim kiem san pham/CPE
├── epss/
│ └── index.ts EPSS — score, top
├── kev/
│ └── index.ts KEV — check, search, recent (cached)
├── ghsa/
│ └── index.ts GitHub Advisory — search, get
├── osv/
│ └── index.ts OSV — query, get, batch
├── exploit/
│ └── index.ts Tim PoC qua GitHub repos
├── shodan/
│ └── index.ts Shodan CVEDB + InternetDB (khong can xac thuc)
├── vulncheck/
│ └── index.ts VulnCheck KEV, CPE, PURL
├── vulners/
│ └── index.ts Vulners search + lookup
├── nuclei/
│ └── index.ts Kiem tra su ton tai Nuclei template
├── metasploit/
│ └── index.ts Kiem tra MSF module (cached metadata)
├── cpe/
│ └── index.ts NVD CPE dictionary API
├── circl/
│ └── index.ts CIRCL CVE enrichment
├── attackerkb/
│ └── index.ts AttackerKB assessments
├── attack/
│ └── index.ts CWE → MITRE ATT&CK mapping
├── cwe/
│ └── index.ts CWE API (MITRE) + static fallback
├── cvss/
│ └── index.ts CVSS v3.1 + v4.0 parser + calculator
├── meta/
│ ├── enrich.ts Lam giau CVE day du (8 nguon song song)
│ ├── prioritize.ts Xep hang CVE dua tren rui ro
│ ├── trending.ts CVE trending theo EPSS
│ ├── compare.ts So sanh CVE canh nhau
│ └── sources.ts Kiem tra tinh trang 11 nguon
└── utils/
├── rate-limiter.ts Bo gioi han toc do dua tren hang doi
└── cache.ts TTL cache
```
**Quyet dinh thiet ke:**
- **Tinh bao, khong phai kiem toan** — Khac voi [cloud-audit-mcp](https://github.com/badchars/cloud-audit-mcp) va [github-security-mcp](https://github.com/badchars/github-security-mcp), day la cong cu du lieu. Khong co CheckResult, khong co tich luy phat hien. Moi truy van doc lap va khong trang thai.
- **Lam giau song song** — `cve_enrich` goi 8 nguon qua `Promise.allSettled`. Neu mot nguon bi loi, cac nguon con lai van tra ve du lieu.
- **Phat hien vu khi hoa** — Kiem tra su ton tai cua Nuclei template va Metasploit module de danh dau CVE co cong cu exploit cong khai.
- **Bo gioi han toc do dung chung** — Tat ca module NVD dung chung mot instance `RateLimiter` (6 giay giua cac yeu cau) de tranh loi 429.
- **Cache KEV + MSF** — Danh muc KEV (~1200 muc) va MSF module metadata (~15MB) duoc tai mot lan, cache voi TTL 1 gio.
- **CWE dual-mode** — MITRE CWE REST API cho chi tiet day du (1000+ CWEs), voi static fallback 40+ muc khi API khong kha dung.
- **CVSS v3.1 + v4.0** — Tu dong phat hien phien ban tu vector prefix. V4.0 su dung phuong phap MacroVector scoring.
- **ATT&CK mapping** — Bang CWE-to-technique tinh (33 muc CWE → ATT&CK techniques). Khong can goi API.
- **2 dependencies** — `@modelcontextprotocol/sdk` va `zod`. Khong co gi khac.
---
## Han Che
- NVD API khong co `NVD_API_KEY` bi gioi han 5 yeu cau moi 30 giay. Dat key cho su dung production
- Tim kiem GitHub Advisory khong co `GITHUB_TOKEN` bi gioi han 60 yeu cau moi gio
- VulnCheck, Vulners va AttackerKB yeu cau API keys cho chuc nang day du
- Tim kiem exploit su dung tim kiem GitHub repository co rate limit rieng
- MSF module metadata (~15MB) duoc tai khi su dung lan dau — cuoc goi `msf_check` dau tien se cham hon
- Cham diem CVSS v4.0 su dung MacroVector approximation (dac ta chinh xac rat phuc tap)
- ATT&CK mapping bao phu 33 muc CWE — CWE khong pho bien co the khong anh xa duoc
- macOS / Linux (Windows chua duoc kiem thu)
---
## Mot Phan cua MCP Security Suite
| Du an | Linh vuc | Cong cu |
|---|---|---|
| [hackbrowser-mcp](https://github.com/badchars/hackbrowser-mcp) | Kiem thu bao mat qua trinh duyet | 39 cong cu, Firefox, kiem thu injection |
| [cloud-audit-mcp](https://github.com/badchars/cloud-audit-mcp) | Bao mat dam may (AWS/Azure/GCP) | 38 cong cu, 60+ kiem tra |
| [github-security-mcp](https://github.com/badchars/github-security-mcp) | Tinh trang bao mat GitHub | 39 cong cu, 45 kiem tra |
| **cve-mcp** | Tinh bao lo hong | 41 cong cu, 11 nguon |
---
Chi danh cho kiem thu va danh gia bao mat duoc uy quyen.
Luon dam bao ban co su uy quyen phu hop truoc khi kiem thu he thong.
