Model Context Protocol

CVE & exposure intelligence, inside your AI tools

The EchelonGraph MCP server puts our real-time CVE feed — NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, fused into one score — and the one thing no other CVE source has, the live internet-exposure footprint of a CVE, directly into Claude, Cursor, Cline, or any MCP client. Free, no API key.

Browse the CVE Pulse feed →

Install (60 seconds)

It runs via npx — no global install. Add it to your client’s MCP config, then restart.

Claude Desktop · Cursor · Cline · Windsurf

{
  "mcpServers": {
    "echelongraph": {
      "command": "npx",
      "args": ["-y", "echelongraph-mcp"]
    }
  }
}

(Claude Desktop: claude_desktop_config.json · Cursor: ~/.cursor/mcp.json — same block.)

Then ask your assistant: “Is CVE-2023-44487 actively exploited, and how exposed is the internet to it right now?”

Tools

cve_summary

Live counts of active CVEs by severity + feed freshness.

Ask: “How many critical CVEs are active right now?”

search_cves

Search/filter CVEs (severity, min CVSS, text, sort) with EchelonGraph scores.

Ask: “Find recent KEV-listed CVEs affecting nginx.”

get_cve

Full detail for one CVE — CVSS v3/v4, EG score, EPSS, KEV + ransomware, GHSA, CWE, references.

Ask: “Give me the full picture on CVE-2024-3094.”

cve_exposureUnique

The live internet-exposure footprint of a CVE — how many exposed hosts run an affected version right now.

Ask: “How exposed is the internet to CVE-2023-44487?”

exposure_radar

Live totals across the exposure radars — shadow AI, KEV-exploited hosts, open databases, leaked creds.

Ask: “What is the current state of exposed databases and leaked creds?”

What you can ask

Once it’s connected, just ask in natural language — your assistant picks the right tool and answers with live data:

“Is CVE-2024-3094 actively exploited, and how exposed is the internet to it right now?”
“Show me this week's critical CVEs affecting OpenSSL.”
“What's the EchelonGraph score and KEV status of CVE-2023-44487?”
“How many unauthenticated databases and leaked credentials are exposed right now?”

Why it's different

Most CVE sources tell you that a vulnerability exists. EchelonGraph also runs a passive internet-exposure radar — so cve_exposure tells your AI assistant how much of the internet is exposed to a CVE right now, with a country and product breakdown. No other CVE feed can answer that, because no other CVE feed runs the radar too. It’s all aggregate and host-redacted, served under our free public API.

Open source · MIT · Public API docs · KEV-Exposure radar