Cisa Kev

What Cisa Kev does

Cisa Kev makes CISA's Known Exploited Vulnerabilities (KEV) catalog available to MCP clients and HTTP callers. The catalog covers actively exploited CVEs and includes required-action dates alongside other entry metadata. It is intended for agents that need to inspect vulnerability records, identify affected vendors, or find additions made within a recent time window.

The integration is independent and unofficial; it is not affiliated with, endorsed by, or published by CISA.

How it works

The server reads CISA's published JSON feed at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. The in-pack data is cached for one hour. No API key is required for the standalone package, and the first calls to the hosted HTTP interface do not require an account.

There are two connection models. The hosted pack endpoint is available at https://gateway.pipeworx.io/cisa-kev/mcp. The same gateway also provides a full endpoint at https://gateway.pipeworx.io/mcp; the pack endpoint lists Cisa Kev's tools directly while both endpoints can reach Pipeworx's broader routing through ask_pipeworx.

The package can instead run as a local stdio MCP process. In that mode, it responds to MCP initialization, tool listing, and tool calls for the Cisa Kev tools only.

Setup and configuration

For a hosted connection, add the pack endpoint to an MCP client:

{
  "mcpServers": {
    "cisa-kev": {
      "url": "https://gateway.pipeworx.io/cisa-kev/mcp"
    }
  }
}

For local use, configure the package as a command-based server:

{
  "mcpServers": {
    "cisa-kev": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-cisa-kev"]
    }
  }
}

You can also start it directly with npx -y @pipeworx/mcp-cisa-kev. For HTTP clients, the hosted tools can be called through paths such as POST https://gateway.pipeworx.io/v1/tools/catalog with a JSON request body.

Tools and capabilities

• catalog() returns the complete catalog with metadata and vulnerability entries.
• entry(cve_id) retrieves one KEV record by CVE identifier.
• vendors() returns the distinct vendors represented in the catalog.
• recent(days) finds entries added during the specified number of preceding days.

The hosted gateway adds shared Pipeworx meta-tools to the pack endpoint's tool list, including ask_pipeworx, discover_tools, search_within, remember, and recall. The local stdio process exposes only the four Cisa Kev tools. With the gateway, ask_pipeworx can route plain-language questions across the wider Pipeworx catalog.

Limitations and notes

The hosted endpoint's tool list is larger than the pack-specific list because of the gateway-wide meta-tools. The exact scope is stated by the MCP initialize response. Local stdio avoids those additional tools but also does not provide the gateway's cross-catalog routing. Because the data is cached for one hour, newly published CISA entries may not appear immediately.