Vulnerability Registry MCP

An MCP server that wraps a legacy pipe-delimited vulnerability database and exposes it as a set of tools that any MCP-compatible LLM client can use.

The server loads two flat files (vendors.db, vulnerabilities.db), parses them with a metadata-driven parser, holds the data in memory behind purpose-built indexes, and answers the kinds of questions a security analyst actually asks — "how many critical vulnerabilities are still open?", "which CVEs were published for the Linux Kernel in the past year?", "what's the CVSS score of Log4Shell?"

Quick start

npm install
npm run build
npm start

The server speaks MCP over stdio and reads its data files from the package root by default. Override the locations with environment variables if needed:

VRMCP_VENDORS_PATH=/path/to/vendors.db \
VRMCP_VULNERABILITIES_PATH=/path/to/vulnerabilities.db \
npm start

Connecting from Claude Desktop

Locate claude_desktop_config.json for your platform:

Add (or merge) the following block, replacing the path with the absolute path to your checkout:

{
  "mcpServers": {
    "vulnerability-registry": {
      "command": "node",
      "args": ["/absolute/path/to/vulnerability-registry-mcp/dist/index.js"]
    }
  }
}

On Windows, use the full path to node.exe if Claude Desktop cannot resolve it from PATH:

{
  "mcpServers": {
    "vulnerability-registry": {
      "command": "C:\\Program Files\\nodejs\\node.exe",
      "args": ["C:\\path\\to\\vulnerability-registry-mcp\\dist\\index.js"]
    }
  }
}

Fully quit and relaunch Claude Desktop. The seven tools listed below appear in the + → Connectors picker.

Development

npm run dev        # run the server with tsx, no build step
npm test           # run the Vitest suite (44 tests)
npm run lint       # ESLint with type-aware rules
npm run typecheck  # tsc --noEmit

Tools

All tools return JSON-formatted text content. Inputs are validated with Zod; invalid arguments produce a structured error result.

list_vendors

Browse the vendor catalogue. Optional filters:

• category — exact category match (e.g. "Open Source")
• query — case-insensitive substring match against name and category

get_vendor

Fetch a single vendor and a summary of its vulnerabilities (total, open critical count, most recent CVE).

• idOrName — vendor id ("V1") or name ("Apache Software Foundation")

search_vulnerabilities

The workhorse query. Compose any combination of:

• severity — one severity or an array (critical, high, medium, low, info)
• status — open or patched
• vendorId / vendorName
• minCvss / maxCvss — numeric range, 0–10
• publishedAfter / publishedBefore — ISO dates (YYYY-MM-DD)
• query — free-text matched against title, CVE id and affected versions
• limit — cap the number of results

Results are returned newest-first.

get_vulnerability

Look up a single vulnerability by CVE id ("CVE-2021-44228") or internal id ("CVE001"). The response includes the linked vendor profile.

get_vulnerability_stats

Aggregated counts: total, by severity, by status, by vendor, by publication year. Accepts the same filters as search_vulnerabilities, which is what makes "how many critical vulnerabilities are still open" a single tool call (severity=critical, status=open).

top_vulnerable_vendors

Rank vendors by their vulnerability footprint. Sort dimensions:

• count (default) — total vulnerabilities
• averageCvss
• maxCvss
• openCount — number of unpatched issues

Optional severity /

... View full README on GitHub