io.github.cyanheads/cisa-cybersecurity-mcp-server · v0.3.2 · security
io.github.cyanheads/cisa-cybersecurity-mcp-server is healthy: it completed an MCP handshake in 448 ms and exposes 7 tools.
CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.
Endpoint: https://cisa-cybersecurity.caseyjhand.com/mcp (streamable-http)
Repository · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 7 |
| Latency | 448 ms |
| Last checked (UTC) | 2026-10-16T07:15:41.789Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-10-16T07:15:41.789Z | Healthy | 448 | |
| 2026-10-15T03:20:52.138Z | Healthy | 3220 |
cisa_list_reference | Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells the |
cisa_check_cve_status | Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding ope |
cisa_search_kev | Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage t |
cisa_get_ssvc | Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you |
cisa_search_ics_advisories | Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publicatio |
cisa_get_advisory | Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sect |
cisa_get_alerts | List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on |