NestDaddy

Cisa Cybersecurity Mcp Server

io.github.cyanheads/cisa-cybersecurity-mcp-server · v0.4.1

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Connect Remote server

Terminal
claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp
~/.cursor/mcp.json
{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "http",
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
    }
  }
}
Claude Desktop
Settings > Connectors > Add custom connector
URL: https://cisa-cybersecurity.caseyjhand.com/mcp

Tools 7 found in our last check

  • cisa_list_reference

    Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advis…

  • cisa_check_cve_status

    Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overd…

  • cisa_search_kev

    Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-…

  • cisa_get_ssvc

    Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for th…

  • cisa_search_ics_advisories

    Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, adviso…

  • cisa_get_advisory

    Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and revision history. Large advisories return a section outline with byte sizes and…

  • cisa_get_alerts

    List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Cursors continue within the current 30-item rolling window; upstream provides no pagination, history, or date-range query. The window's coverage varies from about a wee…

Details

Endpointhttps://cisa-cybersecurity.caseyjhand.com/mcp (Streamable HTTP)
Package@cyanheads/[email protected] (NPM, stdio)
Package@cyanheads/[email protected] (NPM, streamable-http)
First published11 Nov 2026
Last updated11 Nov 2026
Registry nameio.github.cyanheads/cisa-cybersecurity-mcp-server

More search and web servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.