Cisa Cybersecurity MCP Server

Last 30 days

Uptime

100%

Response time

423 ms typical, 423 ms slowest 5%

Last check

1 h ago

Next check

in 5 h

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "type": "http",
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
    }
  }
}

7 tools

• cisa_list_reference

  Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the adviso

• cisa_check_cve_status

  Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdu

• cisa_search_kev

  Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-d

• cisa_get_ssvc

  Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the

• cisa_search_ics_advisories

  Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisor

• cisa_get_advisory

  Read one CISA industrial control system advisory in full: affected products flattened from the CSAF product tree into vendor, product, and version ranges; per-CVE CVSS score, vector, and CWE; remediations with their category and vendor instructions; critical-infrastructure sector

• cisa_get_alerts

  List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks