vuln-intel

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/rozetyp-vuln-intel

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

12 read · 0 write · 0 deleteRead-only

Secrets

1 (API keys, tokens or passwords)

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (12)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• assist_submissionStrengthen a bug-bounty submissionread-only

  Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports: (1) precedent & validity — is this an accepted class, with citable reports (ammunition if it was disputed/closed); (2) what's novel/stronger about yours — what to lead with; (3) an escalation playbook INCLUDING moves you may NOT have tried, each with honest feasibility; (4) submission-framing tips. Every cited report URL is validated against the retrieved corpus — unground…

• check_technologyCVEs for a product and versionread-only

  Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron, apache; "Envoy" → envoyproxy, enphase), the result is flagged `ambiguous` with `distinct_vendors` — pass `vendor=` to disambiguate. Always check each result's `match.products` (vendor:product) before trusting a hit. Args: product: product or package name, e.g. "nginx", "Keycloa…

• corpus_statsCorpus size and freshnessread-only

  Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps).

• enrich_cveEnrich a CVEread-only

  Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with rationale, affected products/versions, and (live) public-exploit signal. Args: cve_id: e.g. "CVE-2025-12345". include_poc: also query GitHub for public PoC/exploit repos (live).

• find_attack_approachesFind attack approaches from disclosed bounty reportsread-only

  Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE. The "what approach worked on a bug like this, on which program, and what did it pay" layer: grounded in real publicly-disclosed, paid HackerOne reports, each distilled to a transferable mechanic (bug_class / source / sink / trigger / impact) and embedded in the same space as the corpus. Use it to BORROW a proven attack approach for a target or CVE you're working — especially to get UNSTUCK: result…

• find_continuationsNext moves from a hunt positionread-only

  When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the distilled card. This is the "I have a messy pile of capabilities, what are my legal moves?" layer. position: a product-free statement of what you can already do, e.g. "a backend fetches a user-supplied URL during import/webhook and I can't read the response (blind)", or "I hold a l…

• hunt_planRank a recon'd stack into a dig orderread-only

  Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by real in-the-wild exploitation — i.e. WHERE to look first and WHAT shape to expect. Components are ordered by their most-exploitable bug (`dig_rank`). Grounded in exploitation data, not model guesses; lays out facts for triage/where-to-look, never a payload. Args: technologies: disco…

• observeScan a host's exposed stackread-only

  Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS into a dig-order. Fetches only public pages — authorized targets only. NON-BLOCKING: a scan takes ~1-4 min, so observe() never waits on it. A recent scan (<24h) returns status="ready" instantly. A cache miss KICKS a background scan and returns status="scanning" immediately — POLL by calling observe() again with t…

• program_outcome_priorWhat lands on a bounty programread-only

  At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide what to look at first and what to skip. Built from real HackerOne disclosed reports: the class distribution for this program, each with LIFT over the global base-rate, sample size, and cited example reports; plus `lands_rarely` — the classes that land broadly across programs but almost never here (where NOT to spend the first hour). DESCRIPTIVE, not predictive: it reports what *landed*, never claims what you *will* find. It's a d…

• search_public_codeFind public copies of a code stringread-only

  Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a distinctive line or symbol from the vulnerable function, then FETCH AND READ the hits to judge which copies are still unpatched, reachable, or just fossils/forks. Returns RAW search results only -- it makes no vulnerability judgment; that reasoning is yours. Args: code: an exact code string, e.g. "VP8LBuildHuffmanTable" or a distinctive line. lang: language filter for the code search (default "c"). …

• search_vulnsSearch CVEs by concept, keyword or seed CVEread-only

  Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "SSO SAML assertion replay", "deserialization gadget chain", "server-side request forgery cloud metadata"). By default it FUSES full-text keyword search AND semantic mechanism-search, so you don't have to guess whether your phrasing is lexical or conceptual. order='relevance' = keyword only; order='similarity' = semantic only; order='severity' = fuse then rank P1>P4. …

• verify_cve_claimFact-check a CVE claimread-only

  Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the claimed product at the claimed version; is the severity right; is it actually KEV-exploited. Returns per-assertion verdicts (supported / refuted / unverifiable) with cited evidence. Use it to check what another agent (or a draft report) asserted, e.g. "CVE-2021-44228 is a critical RCE in Log4j 2.17, actively exploited" → verify_cve_claim("CVE-2021-44228", product="log4j", version="2.17.0", severity="critica…

Signals

Stars

0

Forks

0

Open issues

0

Last commit

Oct 16, 2026 (13 days ago)

Last release

Oct 10, 2026 (19 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.rozetyp/vuln-intel

Version

1.0.2

Auth

Bearer token

License

License unknown

Repository

github.com/rozetyp/vuln-intel-mcp

Website

vulntel.com

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql