# Cisa Kev [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-cisa-kev  
**GitHub Stars:** 0  
**npm Downloads (last month):** 435  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/cisa-kev

## Description
CISA Known Exploited Vulnerabilities catalog

## Tools
Capabilities this server exposes over MCP:

- **catalog** — Full KEV catalog (metadata + entries).
- **entry** — Single KEV entry by CVE id.
- **vendors** — Return all distinct vendor/project names in the CISA KEV catalog sorted by entry count descending, with per-vendor counts. Useful for identifying which vendors have the most actively-exploited vulnerabilities.
- **recent** — Entries added in the last N days.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "cisa-kev": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-cisa-kev"]
  }
}
```

## Documentation

## What Cisa Kev does

Cisa Kev makes CISA's Known Exploited Vulnerabilities (KEV) catalog available to MCP clients and HTTP callers. The catalog covers actively exploited CVEs and includes required-action dates alongside other entry metadata. It is intended for agents that need to inspect vulnerability records, identify affected vendors, or find additions made within a recent time window.

The integration is independent and unofficial; it is not affiliated with, endorsed by, or published by CISA.

## How it works

The server reads CISA's published JSON feed at `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`. The in-pack data is cached for one hour. No API key is required for the standalone package, and the first calls to the hosted HTTP interface do not require an account.

There are two connection models. The hosted pack endpoint is available at `https://gateway.pipeworx.io/cisa-kev/mcp`. The same gateway also provides a full endpoint at `https://gateway.pipeworx.io/mcp`; the pack endpoint lists Cisa Kev's tools directly while both endpoints can reach Pipeworx's broader routing through `ask_pipeworx`.

The package can instead run as a local stdio MCP process. In that mode, it responds to MCP initialization, tool listing, and tool calls for the Cisa Kev tools only.

## Setup and configuration

For a hosted connection, add the pack endpoint to an MCP client:

```json
{
  "mcpServers": {
    "cisa-kev": {
      "url": "https://gateway.pipeworx.io/cisa-kev/mcp"
    }
  }
}
```

For local use, configure the package as a command-based server:

```json
{
  "mcpServers": {
    "cisa-kev": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-cisa-kev"]
    }
  }
}
```

You can also start it directly with `npx -y @pipeworx/mcp-cisa-kev`. For HTTP clients, the hosted tools can be called through paths such as `POST https://gateway.pipeworx.io/v1/tools/catalog` with a JSON request body.

## Tools and capabilities

- `catalog()` returns the complete catalog with metadata and vulnerability entries.
- `entry(cve_id)` retrieves one KEV record by CVE identifier.
- `vendors()` returns the distinct vendors represented in the catalog.
- `recent(days)` finds entries added during the specified number of preceding days.

The hosted gateway adds shared Pipeworx meta-tools to the pack endpoint's tool list, including `ask_pipeworx`, `discover_tools`, `search_within`, `remember`, and `recall`. The local stdio process exposes only the four Cisa Kev tools. With the gateway, `ask_pipeworx` can route plain-language questions across the wider Pipeworx catalog.

## Limitations and notes

The hosted endpoint's tool list is larger than the pack-specific list because of the gateway-wide meta-tools. The exact scope is stated by the MCP `initialize` response. Local stdio avoids those additional tools but also does not provide the gateway's cross-catalog routing. Because the data is cached for one hour, newly published CISA entries may not appear immediately.

_Full upstream README: https://allmcps.com/mcp/cisa-kev/readme_