Log inSubmit server
Patch Tuesday MCP logo

Patch Tuesday MCP

by jonnybottles

Queries Microsoft Patch Tuesday data for CVEs, KBs, affected products, exploitation status, and patch-triage priorities.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Patch Tuesday MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "jonnybottles-patch-tuesday-mcp": {
      "command": "uvx",
      "args": [
        "patch-tuesday-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

jonnybottles/patch-tuesday-mcp MCP server exposes Microsoft security-update data through one MCP tool, msrc_search. It queries the public MSRC Security Update Guide API and enriches results with FIRST.org EPSS scores and CISA KEV data when available. Use it to inspect monthly releases, map CVEs to KB articles, filter affected products, examine supersedence, and prioritize exploited or high-risk vulnerabilities. Local execution requires no API key, and a hosted remote endpoint is also available.

Use cases

  • Triage the latest Microsoft Patch Tuesday release
  • Map installed KB articles to fixed CVEs
  • Prioritize exploited or high-EPSS vulnerabilities
  • Check whether a KB is superseded
  • Review Microsoft-confirmed update issues before deployment

Key features

  • Searches MSRC Patch Tuesday releases
  • Looks up CVEs and KB articles
  • Filters by product, severity, CVSS, EPSS, and exploitation
  • Enriches results with CISA KEV data
  • Follows KB supersedence chains
  • Exports Markdown triage reports and CSV data

Tools1

What Patch Tuesday MCP lets your agent do. Expand a tool for its parameters.

Verified live~4.7k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

8/8 checks healthy over the last 85d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 6d ago via OSV.dev · patch-tuesday-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars5Stargazers on the source repository.
Last commit25d agoMost recent push to the default branch.
Tools exposed1Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Patch Tuesday MCP works

What jonnybottles/patch-tuesday-mcp does

jonnybottles/patch-tuesday-mcp MCP server lets an MCP-compatible assistant query Microsoft's monthly security updates without navigating the MSRC portal manually. Its data comes from the public MSRC CVRF v3 API and covers CVEs, KB articles, affected products, severity, CVSS information, Microsoft's exploitation assessment, and release metadata.

The server is designed around Patch Tuesday releases rather than isolated CVE records. It can summarize a release, search one or more historical months, identify vulnerabilities affecting a product or product family, and return aggregate counts. Results can also include FIRST.org EPSS predictions and CISA Known Exploited Vulnerabilities catalog details, including remediation due dates when available.

How it works

The server provides one MCP tool, msrc_search. The tool accepts optional filters that can be used alone or combined. With no filters, it selects the latest released Patch Tuesday and orders results by urgency: KEV-listed or exploited issues first, followed by EPSS, severity, and CVSS criteria.

CVE lookups use a fast path that searches across months and can return affected products, KBs, descriptions, CVSS data, references, EPSS information, and KEV status. KB lookups can identify the CVEs fixed by an article, process up to 30 KBs in one request, follow Microsoft's supersedence links, and optionally retrieve known issues or update-summary content from the Microsoft support page.

Historical searches can cover a bounded number of released months and return per-month counts. The tool also supports pagination, statistics, Markdown triage reports, CSV output, release-catalog discovery, cache refreshes, and freshness metadata.

Setup and configuration

Run the package locally with Python 3.11 or later and an MCP-compatible client. The recommended command is:

text
uvx patch-tuesday-mcp

The package can alternatively be installed with pip install patch-tuesday-mcp. Using uvx requires uv to be installed first. No MSRC account, authentication token, or API key is required because the source API is public.

A hosted remote MCP endpoint is also documented by the project, allowing use without a local installation. The project states that local execution is preferable for heavy use or guaranteed availability. Named product watchlists are matched locally. Built-in profiles can be overridden or extended with a JSON file referenced by MSRC_PROFILES_PATH; profile contents are not sent to MSRC, FIRST.org, CISA, or telemetry.

Tools and capabilities

msrc_search supports:

  • CVE, keyword, KB, product, product-family, severity, CWE, and release-month searches.
  • Batch lookup for up to 30 KB article numbers.
  • Filters for exploitation, public disclosure, CISA KEV presence, ransomware use, Microsoft's exploitation forecast, EPSS, CVSS, and parsed attack-vector fields.
  • Supersedence chains, KB details, Microsoft-confirmed known issues, update summaries, and CVE guidance when requested.
  • Monthly statistics, historical trends, pagination, available-month catalogs, and Markdown or CSV triage output.
  • Optional reference links, KEV detail fields, temporal CVSS scores, cache refreshes, and freshness reporting.

Limitations and notes

The project is an independent implementation, not an official Microsoft tool or service. Its default month selection skips a newer pre-Patch-Tuesday document unless that month is explicitly requested. Pre-release documents may contain only early Chromium, third-party, or out-of-band entries.

Known-issue and update-summary fields are fetched on a best-effort basis from Microsoft support pages. A response distinguishes published information, no published section, and unavailable or unparseable content; unavailable does not mean that Microsoft confirmed there are no issues. Product profiles and their matching logic remain local to the server.

The tool reports information available from MSRC, FIRST.org, CISA, and relevant Microsoft support pages. It does not predict behavior in a particular environment or replace testing and deployment assessment.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Patch Tuesday MCP

jonnybottles/patch-tuesday-mcp is an MCP server that connects AI assistants to Microsoft's public MSRC Security Update Guide API. Its main tool, msrc_search, searches Patch Tuesday releases, CVEs, KB articles, products, severity, exploitation status, EPSS scores, CISA KEV data, supersedence chains, and historical trends without requiring an API key.

Install or run it with `uvx patch-tuesday-mcp`; alternatively, use `pip install patch-tuesday-mcp`. Local use requires Python 3.11 or later, an MCP-compatible client, and `uv` when using `uvx`. No Microsoft credentials or API key are required.

Use the `msrc_search` tool with filters such as `cve`, `kb`, `query`, `product`, `severity`, `exploited`, `kev`, `min_epss`, or `min_cvss`. Leave filters empty to retrieve the most urgent vulnerabilities from the latest released Patch Tuesday.

Yes. Pass a KB number with `include_chain=true` to walk Microsoft's stated supersedence links. Add `include_known_issues=true` to retrieve Microsoft-confirmed symptoms, workarounds, and resolving updates from the KB support page when that information is available.

Yes. The project lists Cursor as an MCP-compatible client. Configure the local stdio server with `uvx patch-tuesday-mcp`, or use the documented hosted remote endpoint if the client supports the required remote MCP connection.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewPatch Tuesday MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/jonnybottles-patch-tuesday-mcp?style=directory)](https://allmcps.com/mcp/jonnybottles-patch-tuesday-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/jonnybottles-patch-tuesday-mcp"><img src="https://allmcps.com/api/badge/jonnybottles-patch-tuesday-mcp?style=directory" alt="Patch Tuesday MCP on AllMCPs" /></a>