cisa-cybersecurity-mcp-server

<div align="center">
  <h1>@cyanheads/cisa-cybersecurity-mcp-server</h1>
  <p><b>CISA Known Exploited Vulnerabilities with BOD 26-04 deadlines, SSVC prioritization, and the full ICS advisory corpus (CSAF) via MCP. Keyless. STDIO & Streamable HTTP.</b>
  <div>7 Tools • 2 Resources</div>
  </p>
</div>

<div align="center">

[![Version](https://img.shields.io/badge/Version-0.1.2-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/cisa-cybersecurity-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.0.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/cisa-cybersecurity-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/cisa-cybersecurity-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.0-blueviolet.svg?style=flat-square)](https://bun.sh/)

</div>

<div align="center">

[![Install in Claude Desktop](https://img.shields.io/badge/Install_in-Claude_Desktop-D97757?style=for-the-badge&logo=anthropic&logoColor=white)](https://github.com/cyanheads/cisa-cybersecurity-mcp-server/releases/latest/download/cisa-cybersecurity-mcp-server.mcpb) [![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=cisa-cybersecurity-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvY2lzYS1jeWJlcnNlY3VyaXR5LW1jcC1zZXJ2ZXIiXX0=) [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=for-the-badge&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22cisa-cybersecurity-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fcisa-cybersecurity-mcp-server%22%5D%7D)

[![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-67E8F9?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)

</div>

<div align="center">

**Public Hosted Server:** [https://cisa-cybersecurity.caseyjhand.com/mcp](https://cisa-cybersecurity.caseyjhand.com/mcp)

</div>

---

## Overview

CISA's open vulnerability outputs, made queryable: the Known Exploited Vulnerabilities catalog and the federal remediation deadlines it carries, the SSVC decision points CISA publishes per CVE in Vulnrichment, the full CSAF corpus of industrial control system advisories back to 2010, and CISA's current publication feeds. Check a scan's worth of CVE IDs against KEV in one call, find what is overdue for a vendor, work out what BOD 26-04 implies for an asset you own, and search or read ICS advisories by vendor, product, CVE, CVSS, or sector. Every source is keyless and read-only. Runs as a stdio process, a local Streamable HTTP server, or the public hosted endpoint above.

### Tools

| Tool | Description |
|:---|:---|
| `cisa_list_reference` | Decode the vocabulary the other tools take as input — BOD 26-04 timelines, KEV fields, SSVC values, sector names, ID formats, severity bands, and what data this server currently holds |
| `cisa_check_cve_status` | Check up to 200 CVE IDs against the KEV catalog in one call — remediation deadlines, overdue status, ransomware and forensic-triage flags, and the directive each entry cites |
| `cisa_search_kev` | Search the KEV catalog by vendor, product, CWE, date added, due date, overdue status, ransomware linkage, forensic-triage tier, or directive |
| `cisa_get_ssvc` | Fetch the SSVC decision points CISA publishes per CVE and compute the BOD 26-04 remediation timeline they imply for a stated asset exposure |
| `cisa_search_ics_advisories` | Search the ICS advisory corpus by vendor, product, CVE, CVSS range, severity, sector, series, or free text over titles and product names |
| `cisa_get_advisory` | Read one ICS advisory in full — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history |
| `cisa_get_alerts` | List what CISA has published recently from its advisory, alert, or ICS advisory feed |

### Resources

| Resource | Description |
|:---|:---|
| `cisa://kev/{cveId}` | One KEV catalog entry by CVE ID |
| `cisa://advisory/{advisoryId}` | One ICS advisory, flattened from CSAF 2.0 |

Both resources are fully covered by the tools above, so a tool-only client loses nothing.

## Capability reference

### `cisa_list_reference` <sub>tool</sub>

- One required `topic`: `directives`, `kev_fields`, `ssvc_values`, `sectors`, `advisory_id_formats`, `severity_bands`, or `sources`
- `directives` returns all sixteen rows of BOD 26-04 Appendix A, Table 1 as data — row number, the four decision points, the timeline label in the directive's own wording, `remediationTimelineDays`, and `forensicTriageRequired` — plus the directive's supporting definitions and what it supersedes
- `sources` reports what this server currently holds: the KEV snapshot's `catalogVersion` and last check, the advisory index's readiness, document count and sync status, the SSVC cache TTL, and the cached feed windows
- Reads in-process state only and makes no network call, so it stays answerable while another tool is failing — which is why every recovery hint on this surface routes here

---

### `cisa_check_cve_status` <sub>tool</sub>

- Up to 200 CVE IDs per call, answered from the cached catalog snapshot at zero upstream cost
- Per CVE: `inKev`, and when present `dateAdded`, `dueDate`, `daysUntilDue`, `overdue`, `requiredAction`, `knownRansomwareCampaignUse`, `forensicTriage`, CISA's `vendorProject` / `product` labels, `cwes[]`, and `references[]` typed by `kind` (`nvd`, `cisa`, `bod_guidance`, `forensic_triage`, `vendor`, `other`)
- `directive` is three-state — `BOD 26-04`, `BOD 22-01`, or `null` for the entries citing neither; it is never inferred from an entry's age
- A CVE that is not in KEV is a normal result, not an error
- Echoes the catalog snapshot that answered the call and the `asOf` date `overdue` and `daysUntilDue` were computed against

---

### `cisa_search_kev` <sub>tool</sub>

- Filters AND together and apply to the whole snapshot, never a page: `vendorProject`, `product`, `nameContains`, `cwe`, `cveIdPrefix`, `dateAddedFrom` / `dateAddedTo`, `dueBefore` / `dueAfter`, `overdue`, `ransomware`, `forensicTriage`, and `directive` (`BOD 26-04` / `BOD 22-01` / `none`)
- Sort by `dueDate` or `dateAdded`; up to 100 per page (default 25) with an opaque cursor, and `totalCount` reports matches before paging
- `vendorProject` and `product` are CISA's own free-text labels, not CPE names — `cisa_list_reference` with topic `kev_fields` carries the value domain
- Setting `dateAddedFrom` adds a caveat: the feed carries no per-record modified timestamp, so the result covers additions in the window, not revisions to existing entries
- Typed errors: `catalog_unavailable` (retryable), `invalid_date_range`

---

### `cisa_get_ssvc` <sub>tool</sub>

- Up to 50 CVE IDs per call — lower than the KEV cap because each CVE needs its own live enrichment lookup rather than a cached batch check
- Returns CISA's published `exploitation`, `automatable`, and `technicalImpact`, plus the CVSS score and CWEs CISA contributes where present
- `assetExposure` (`publicly_exposed` / `not_publicly_exposed` / `unknown`) is the one BOD 26-04 decision point CISA cannot publish; `unknown` returns both arms rather than a guess
- `bod2604.timelines[]` carries the Table 1 row, the label, `remediationTimelineDays` (`null` for the "Fix on system upgrade" rows), and `forensicTriageRequired`, under a fixed caveat that this is CISA's decision table applied to CISA's decision points and your stated exposure — not a compliance determination
- `kevAssigned` reports CISA's own due date side by side, and `assignmentAgrees` surfaces a disagreement as a fact; the two are never reconciled
- A CVE with no published enrichment returns `found: false` with guidance naming the outcome, not an error

---

### `cisa_search_ics_advisories` <sub>tool</sub>

- Full-text `q` over advisory titles, vendor names, and product names — tokens are AND-combined and FTS5 operators in the input are neutralized rather than honored
- Filters: `vendor`, `product`, `cve`, `cvssMin` / `cvssMax`, `severity` (`NONE`–`CRITICAL`), `sector` (the sixteen canonical names plus the `Multiple` sentinel), `series` (`ICSA` / `ICSMA`), `publisher` (`coordinator` = CISA-authored, `other` = republished vendor advisory), `publishedFrom` / `publishedTo`, `revisedFrom` / `revisedTo`
- Sort by `revised` (default), `published`, `maxCvss`, or `relevance` (requires `q`); up to 50 per page (default 20) with an opaque cursor
- Coverage notices fire on the filters that have gaps: sector notes begin in 2017, and some advisories score only in CVSS v2 where the band is derived rather than published
- Results carry `advisoryId` for `cisa_get_advisory`, the CVE set, the cisa.gov `url`, the raw `csafUrl`, and an `attribution` string
- Typed errors: `mirror_not_ready` (retryable), `invalid_cvss_range`, `invalid_date_range`, `relevance_sort_without_query`

---

### `cisa_get_advisory` <sub>tool</sub>

- `advisoryId` is case-insensitive and accepts both real suffix forms (a single letter `a`–`f`, or a numeric `-N`); a trailing `.json` is stripped
- Seven addressable sections: `advisory`, `summary`, `products`, `vulnerabilities`, `revisionHistory`, `references`, `acknowledgments`
- A document over the 24 KB inline budget returns a complete section outline with per-section sizes instead of the whole record — re-call with `sections` to pull what you need; the re-call is stateless
- The `products` a