KEVWire

com.kevwire/kevwireVersion 6.0.0

Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.

Status

Responds1178 msNov 14, 2026, 14:03 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:03 UTC
Latency: 1178 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://kevwire.com/mcpResponds1178 msNov 14, 2026, 14:03 UTC

No sign-in

Claude Code

claude mcp add --transport http kevwire https://kevwire.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: kevwire
Remote MCP server URL: https://kevwire.com/mcp

Cursor

{
  "mcpServers": {
    "kevwire": {
      "url": "https://kevwire.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"kevwire","type":"http","url":"https://kevwire.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

5 tools

Tools of KEVWire
	Description		Read-only	Idempotent	Open world
`get_record`Fetch one record by CVE ID, GHSA ID, or KEVWire record ID, with every source, measurement date, CISA deadline and a permalink. Any published CVE resolves, even outside the tracked set. Returns isError with a hint when nothing matches; then try search_vulnerabilities.	Fetch one record by CVE ID, GHSA ID, or KEVWire record ID, with every source, measurement date, CISA deadline and a permalink. Any published CVE resolves, even outside the tracked set. Returns isError with a hint when nothing matches; then try search_vulnerabilities.	Not declared	Yes	Not declared	No
`list_recent_exploited`Vulnerabilities with documented exploitation (CISA KEV or explicit reporting) published within the last N days, most urgent first. Use it for briefings such as "what was exploited this week"; to narrow by product or words, use search_vulnerabilities with known_exploited_only. Paged with offset and hasMore.	Vulnerabilities with documented exploitation (CISA KEV or explicit reporting) published within the last N days, most urgent first. Use it for briefings such as "what was exploited this week"; to narrow by product or words, use search_vulnerabilities with known_exploited_only. Paged with offset and hasMore.	Not declared	Yes	Not declared	No
`list_sources`Every source KEVWire ingests, with scope, limitations, retrieval status, last success and record counts. Use it to describe coverage honestly or to explain why something may be missing.	Every source KEVWire ingests, with scope, limitations, retrieval status, last success and record counts. Use it to describe coverage honestly or to explain why something may be missing.	Not declared	Yes	Not declared	No
`list_technologies`Technology labels (vendors and products) usable in search_vulnerabilities' technologies filter, with how many records each covers, most covered first. Use it to find the exact label before filtering. Optionally filter by text.	Technology labels (vendors and products) usable in search_vulnerabilities' technologies filter, with how many records each covers, most covered first. Use it to find the exact label before filtering. Optionally filter by text.	Not declared	Yes	Not declared	No
`search_vulnerabilities`Search the KEVWire corpus (CISA KEV, NVD high/critical CVEs, GitHub advisories, national CERTs, security reporting, editorial records) by words, technology, kind or exploitation. Use it to answer "is X affected" or "what is known about Y"; for a known ID use get_record, and for a plain "what is being exploited lately" list use list_recent_exploited. Default order is "urgent": the last 30 days first, then known exploitation, CVSS 9+, breaches. Results are paged (see hasMore and offset) and include source URLs to cite.	Search the KEVWire corpus (CISA KEV, NVD high/critical CVEs, GitHub advisories, national CERTs, security reporting, editorial records) by words, technology, kind or exploitation. Use it to answer "is X affected" or "what is known about Y"; for a known ID use get_record, and for a plain "what is being exploited lately" list use list_recent_exploited. Default order is "urgent": the last 30 days first, then known exploitation, CVSS 9+, breaches. Results are paged (see hasMore and offset) and include source URLs to cite.	Not declared	Yes	Not declared	No

Details

Registry status: Active
Published: Oct 26, 2026
Updated: Oct 26, 2026
Website: https://kevwire.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing