cisa-cybersecurity-mcp-server

io.github.cyanheads/cisa-cybersecurity-mcp-serverVersion 0.5.0

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Status

Responds553 msNov 14, 2026, 14:48 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:48 UTC
Latency: 553 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://cisa-cybersecurity.caseyjhand.com/mcpResponds553 msNov 14, 2026, 14:48 UTC

No sign-in

Claude Code

claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: cisa-cybersecurity-mcp-server
Remote MCP server URL: https://cisa-cybersecurity.caseyjhand.com/mcp

Cursor

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"cisa-cybersecurity-mcp-server","type":"http","url":"https://cisa-cybersecurity.caseyjhand.com/mcp"}'

Streamable HTTP

npm: @cyanheads/cisa-cybersecurity-mcp-server 0.5.0

Package only

npm (npx)

claude mcp add cisa-cybersecurity-mcp-server -- npx -y @cyanheads/cisa-cybersecurity-mcp-server@0.5.0

Streamable HTTP

npm: @cyanheads/cisa-cybersecurity-mcp-server 0.5.0

Package only

npm (npx)

claude mcp add cisa-cybersecurity-mcp-server -- npx -y @cyanheads/cisa-cybersecurity-mcp-server@0.5.0

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

7 tools

Tools of cisa-cybersecurity-mcp-server
	Description		Read-only	Idempotent	Open world
`cisa_check_cve_status`Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.	Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.	Not declared	Yes	Yes	Not declared
`cisa_get_advisory`Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, remediations, flags, or threats. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.	Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, remediations, flags, or threats. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.	Not declared	Yes	Yes	No
`cisa_get_alerts`List recent CISA publications from the combined advisories, alerts, or ICS advisories feed. Cursors continue within the available 30-item rolling window. Upstream provides no pagination, history, or date-range query. See window.oldest and window.newest for the dates the window covers. For ICS advisory history beyond the window, use cisa_search_ics_advisories.	List recent CISA publications from the combined advisories, alerts, or ICS advisories feed. Cursors continue within the available 30-item rolling window. Upstream provides no pagination, history, or date-range query. See window.oldest and window.newest for the dates the window covers. For ICS advisory history beyond the window, use cisa_search_ics_advisories.	Not declared	Yes	Yes	Not declared
`cisa_get_ssvc`Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.	Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.	Not declared	Yes	Yes	Not declared
`cisa_list_reference`Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.	Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.	Not declared	Yes	Yes	No
`cisa_search_ics_advisories`Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles, vendor and product names, and originating vendor advisory reference summaries. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.	Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles, vendor and product names, and originating vendor advisory reference summaries. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.	Not declared	Yes	Yes	No
`cisa_search_kev`Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Use detail "summary" to list and triage entries. Vendor and product are CISA's free-text labels — call cisa_list_reference for the field vocabulary. The catalog records additions and carries no per-record modified timestamp, so dateAddedFrom finds newly added entries while due-date revisions cannot be detected from the feed.	Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Use detail "summary" to list and triage entries. Vendor and product are CISA's free-text labels — call cisa_list_reference for the field vocabulary. The catalog records additions and carries no per-record modified timestamp, so dateAddedFrom finds newly added entries while due-date revisions cannot be detected from the feed.	Not declared	Yes	Yes	Not declared

Details

Registry status: Active
Published: Nov 14, 2026
Updated: Nov 14, 2026
Website: Not given
Repository: https://github.com/cyanheads/cisa-cybersecurity-mcp-server⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing