# Epss [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-epss  
**GitHub Stars:** 0  
**npm Downloads (last month):** 437  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/epss

## Description
FIRST.org EPSS (Exploit Prediction Scoring System) MCP.

## Tools
Capabilities this server exposes over MCP:

- **get_epss** — EPSS exploit-probability for one or more CVEs. Returns each CVE's EPSS score (0-1 = probability it will be exploited in the wild in the next 30 days) and percentile (how it ranks vs all CVEs). Use to gauge real-world exploit likelihood and prioritize patching — complements CVSS severity (a high-severity CVE with low EPSS may be lower urgency than a moderate-severity one with high EPSS).
- **top_exploited** — List the CVEs most likely to be exploited, ranked by EPSS score descending. Answers "which vulnerabilities are most likely to be exploited right now" so you can prioritize patching. EPSS is the probability (0-1) a CVE will be exploited in the wild in the next 30 days; this complements CVSS severity rather than replacing it.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "epss": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-epss"]
  }
}
```

## Documentation

## What Epss does

Epss exposes FIRST.org EPSS data to MCP-compatible AI agents through Pipeworx. EPSS estimates the probability, from 0 to 1, that a CVE will be exploited in the wild during the next 30 days. It also provides a percentile showing how a CVE ranks against other vulnerabilities.

The data is intended to complement CVSS rather than replace it. A vulnerability with high technical severity may have a lower immediate exploitation likelihood, while a less severe issue may deserve faster attention if its EPSS score is high. Epss is therefore suited to triage and patch-ordering workflows where exploit activity probability is an important factor.

This is an independent, unofficial integration and is not affiliated with, endorsed by, or published by FIRST.org.

## How it works

The hosted MCP endpoint is available at `https://gateway.pipeworx.io/epss/mcp`. An MCP client can connect to that URL and call the pack’s tools. The endpoint also exposes shared Pipeworx gateway tools, including `ask_pipeworx`, `discover_tools`, `search_within`, and memory-related tools. The exact tool scope is reported by the connection’s `initialize` response.

A full gateway connection at `https://gateway.pipeworx.io/mcp` exposes the broader Pipeworx catalog directly. Both endpoint styles use the same gateway, while the scoped endpoint lists the Epss pack’s tools directly and retains access to broader routing through `ask_pipeworx`.

For clients that do not use MCP, Pipeworx provides HTTP access. For example, `get_epss` can be called with a JSON body containing a CVE identifier at `/v1/tools/get_epss`.

## Setup and configuration

Add the hosted endpoint to an MCP client such as Claude Desktop, Cursor, or Windsurf:

```json
{
  "mcpServers": {
    "epss": {
      "url": "https://gateway.pipeworx.io/epss/mcp"
    }
  }
}
```

A local stdio bridge is available through npm. Configure the client to run:

```json
{
  "mcpServers": {
    "epss": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-epss"]
    }
  }
}
```

The bridge forwards requests to the hosted gateway and needs network access; it has no offline mode. Anonymous use is capped at 50 calls per day. A free Pipeworx account increases the limit to 200 calls per day. Supply the account key as `PIPEWORX_API_KEY` in the client’s environment configuration. The key is transmitted as a Bearer token, and usage is metered in the same way as hosted connections.

The local bridge lists the Epss pack’s tools by default. Set `PIPEWORX_META_TOOLS=1` to include the shared gateway tools as well. When using an HTTPS proxy, newer Node.js releases can use the proxy environment settings when `NODE_USE_ENV_PROXY=1` is enabled.

## Tools and capabilities

- `get_epss`: Accepts one or more CVEs and returns each vulnerability’s EPSS score and percentile. The score represents predicted exploitation probability over the next 30 days; the percentile indicates relative standing among CVEs.
- `top_exploited`: Returns CVEs ordered by descending EPSS score, helping identify vulnerabilities with the highest predicted exploitation likelihood.
- `ask_pipeworx`: Available through the shared gateway tools when exposed by the connection or when using the full gateway. It accepts a plain-language question and routes it to an appropriate tool.

These capabilities support vulnerability review, exploit-likelihood comparisons, and patch prioritization. EPSS results should be considered together with CVSS and other security context rather than used as a standalone severity rating.

## Limitations and notes

Epss requires access to the Pipeworx gateway for both the hosted endpoint and the npm bridge. The local package does not provide offline operation. Anonymous requests have a daily limit, while authenticated requests require a Pipeworx account key and are metered.

Pack endpoints include shared Pipeworx meta-tools in addition to the pack-specific tools. This increases the number of schemas presented to an MCP client. The endpoint’s initialization response is the authoritative source for the tools exposed during a particular connection.

The package is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/epss/readme_