CVE lookup tools compared

Checked 2026-10-13 by OpenKrill. 8 tools, one of them ours.

Short answer

• Pick Snyk Open Source if the real question is which of your own dependencies are exposed and reachable; no CVE lookup can answer that from an id alone.
• Pick OpenCVE if a person wants CVE pages and email alerts by vendor or product, hosted or self-hosted.
• Pick CVE MCP Server (mukul975) or cve-mcp (badchars) if you run a local MCP server and want threat-intel or exploit-code checks next to CVE data.
• Pick CVE Risk Check if an agent needs CVSS, KEV and EPSS for a list of CVE ids from one remote call, with no install and no key.
• Pick CVE Prioritizer if you have Nessus or OpenVAS reports to rank on the command line.

The tools side by side

Answers from ChatGPT, Gemini, Perplexity, and Claude (API with web search), asked on 2026-10-13 and 2026-10-14. A small sample: read it as a hint, not a ranking. Rows named in 0 answers were added by us, ours included.

The address or command to connect each tool is in Each tool in detail.

What each tool covers

Our test

We asked every hosted tool we could call without an account, a key or an install the same question, with the same inputs. Where that left our tool with no rival, we also ran the rivals a person can use, in their web form, their chat app or their API. Each tested row says how it was run. We wrote down the official answer for each input first, then scored each tool against it on 2026-10-13. The official source an answer comes from is not scored against itself, and an input outside a tool's job is not sent to it, so that tool is scored on the inputs in its scope.

The question: Is this CVE in CISA KEV, and what is its CVSS base score? A score counts when it equals a CVSS base score that the NVD record lists for the CVSS version the tool names (NVD's own score or a CNA or CISA-ADP score shown in the record). KEV must match the CISA feed of 2026-10-08 (catalogVersion 2026.10.08).

1. CVE-2021-44228: KEV yes (added 2021-12-10); CVSS 3.1 base 10.0 (NVD). Official record: cisa.gov, nvd.nist.gov.
2. CVE-2024-3400: KEV yes (added 2024-04-12); CVSS 3.1 base 10.0 (NVD and Palo Alto Networks). Official record: cisa.gov, nvd.nist.gov.
3. CVE-2024-6387: KEV no; CVSS 3.1 base 8.1 (NVD and Red Hat). Official record: cisa.gov, nvd.nist.gov.
4. CVE-2023-22894: KEV yes, added 2026-10-08 (an old CVE added last week); CVSS 3.1 base 4.9 from NVD, 7.2 from CISA-ADP. Official record: cisa.gov, nvd.nist.gov.
5. CVE-2026-88779: KEV yes (added 2026-10-04); CVSS 3.1 base 7.5 from NVD, CVSS 4.0 base 8.7 from Citrix (CNA). Official record: cisa.gov, nvd.nist.gov.

• OpenCVE: 5 of 5 right, 5 answered, median 1.6 s. All 5 right; on CVE-2023-22894 its headline score is the CISA-ADP 7.2, not the NVD 4.9. How it was run: Web page fetch https://app.opencve.io/cve/<id>, no sign-in.
• CVE Risk Check (ours): 4 of 5 right, 4 answered, median 8.8 s. All 4 answers were right, with the new KEV add for CVE-2023-22894; the CVE-2024-3400 call returned nothing after 19 s. How it was run: Remote MCP tools/call check_cve at https://cve.openkrill.app/mcp.

Not tested:

• Snyk Open Source: Needs an account.
• cve-mcp (badchars): Local install only.
• CVE MCP Server (mukul975): Local install only.
• Vulnerability Intelligence MCP (thinkchainai): Local install only.
• cve-mcp-server (K4PXD): Local install only.
• CVE Prioritizer: Local install only.

Every input, official answer and result is in the test data as JSON.

Each tool in detail

Snyk Open Source

Good at: Risk Score weighs reachability, exploit maturity, EPSS and CVSS for your dependencies.

Limit: Needs a Snyk account and a scanned project; reachability covers only some languages.

Data: Snyk Vulnerability Database, FIRST EPSS, CVSS, Snyk exploit maturity, CISA KEV (reference link)

License: Closed source (the Snyk CLI is Apache-2.0)

Repo: snyk/cli

cve-mcp (badchars)

A local server for security work that needs exploit checks: it says whether Metasploit or Nuclei have code for a CVE. It is a large toolset, so an agent has many tools to choose from.

Good at: Runs with npx and checks if Metasploit or Nuclei exploits exist for a CVE.

Limit: Runs only on your machine over stdio; keys are optional, but without an NVD key its NVD calls are capped at 5 requests per 30 seconds.

Data: NVD, FIRST EPSS, CISA KEV, GitHub Advisory (GHSA), OSV.dev, Shodan, VulnCheck, Vulners, Nuclei templates, Metasploit, CIRCL

License: MIT. MCP tools: 41

Repo: badchars/cve-mcp, 30 stars, last commit 2026-07-06

Connect: npx cve-mcp

CVE MCP Server (mukul975)

A local server for teams that already run Python tools and want CVE data next to threat-intel feeds. Its triage_cve call reads NVD, EPSS and KEV in one step; the feeds beyond those need their own keys.

Good at: One triage_cve call checks NVD, EPSS and KEV together, with a KEV override.

Limit: Local Python install; many of its tools need extra keys for threat feeds.

Data: NVD, FIRST EPSS, CISA KEV, OSV.dev, GitHub Advisories, MITRE ATT&CK, AbuseIPDB, GreyNoise, Shodan, VirusTotal, MalwareBazaar, ThreatFox, Ransomwhere, URLScan.io, CIRCL Passive DNS, GitHub Code Search, Exploit-DB, Nuclei Templates, MSRC, Red Hat Security, Ubuntu Security, VulnCheck NVD++, CIRCL hashlookup, HIBP Pwned Passwords

License: Apache-2.0. MCP tools: 28

Repo: mukul975/cve-mcp-server, 1,623 stars, last commit 2026-06-22

Connect: git clone https://github.com/mukul975/cve-mcp-server && pip install -e .

Vulnerability Intelligence MCP (thinkchainai)

A local server for one person or a small team that wants an agent to remember their stack and watchlist. It is a young, small repo, so check its activity before you depend on it.

Good at: Remembers your tech stack and watchlist; triages pasted Trivy or Grype output.

Limit: Small repo with 1 star; last commit 2026-04-08.

Data: NVD, CISA KEV, FIRST EPSS

License: MIT (stated in README; no LICENSE file in the repo). MCP tools: 30

Repo: thinkchainai/vulnerability-intelligence-mcp, 1 star, last commit 2026-04-08

Connect: pip install .

cve-mcp-server (K4PXD)

Good at: cve_batch_triage ranks up to 25 CVEs into a fix-first list.

Limit: You build it from source with npm; no published package; 3 stars.

Data: NVD, CISA KEV, FIRST EPSS, GitHub Security Advisories, nomi-sec PoC-in-GitHub, Exploit-DB, Metasploit, Nuclei templates

License: MIT. MCP tools: 12

Repo: K4PXD/cve-mcp-server, 3 stars, last commit 2026-09-20

Connect: git clone https://github.com/K4PXD/cve-mcp-server && npm install

CVE Prioritizer

Good at: Ranks a CVE list or Nessus and OpenVAS reports by KEV, EPSS and CVSS.

Limit: Command line only, not an MCP server; warns of errors without an NVD key.

Data: NVD, FIRST EPSS, CISA KEV, VulnCheck NVD++ and KEV (optional)

License: BSD-3-Clause

Repo: TURROKS/CVE_Prioritizer, 710 stars, last commit 2026-08-23

Connect: pip install --user cve_prioritizer

OpenCVE

Good at: Source available and self-hostable, or hosted; CVE pages show CVSS, EPSS and KEV, with alerts by vendor and product.

Limit: Hosted alerts and API need an account, and the free plan allows 100 API calls an hour; self-hosting means running it yourself.

Data: NVD, MITRE CVE, CISA Vulnrichment and KEV, Red Hat, FIRST EPSS

License: BUSL-1.1 (source available; becomes Apache-2.0 on 2030-08-14)

Repo: opencve/opencve, 2,859 stars, last commit 2026-10-01

CVE Risk Check (ours)

Good at: Keyless CVSS, CISA KEV, EPSS and a priority for any CVE id; triage_dependencies reads a lockfile or package list and names the 3 upgrades to make first.

Limit: Closed source from one small vendor, no SLA stated; matches exact versions to published advisories, does not scan code or show the flaw is reached.

Data: National Vulnerability Database (NVD), OSV.dev, CISA Known Exploited Vulnerabilities, FIRST EPSS

License: Closed source. MCP tools: 4

Repo: n/a (no public repo)

Connect: https://cve.openkrill.app/mcp

How we compared

On 2026-10-13 we asked ChatGPT, Gemini, Perplexity, and Claude (API with web search) six questions about CVE lookup tools, three "what is the best tool" questions and three "which MCP server should I use" questions:

1. What is the best tool to decide which CVEs to fix first using exploit data like EPSS and CISA KEV?
2. Which tool should I use to prioritize vulnerabilities in my dependencies? Give me your top 3.
3. What are the best CVE lookup and vulnerability prioritization tools right now?
4. Which CVE or vulnerability MCP server should I use with my AI agent?
5. What is the best MCP server for CVE lookup and exploit risk for Claude or ChatGPT?
6. I want my AI agent to rank CVEs by real exploit risk. Which MCP should I install?

24 answers came back with text we could read. "Named in AI answers" counts the answers that named the tool in their text or linked to it; pages an app read but did not cite do not count. The rows are the tools those answers named most, plus tools a reader would expect that the answers missed.

"Right in our test" comes from the measured test above. Every other fact comes from the tool's own page, docs or GitHub repo on the same day. Stars and commit dates change every week, so check the repo before you decide.

OpenKrill makes one of the tools on this page. Its row is sorted by the same count, tested with the same inputs and its limits are listed the same way.

Frequently asked questions

Which CVE MCP server needs no API key?

CVE Risk Check needs no key at all. The mukul975, badchars, thinkchainai and K4PXD servers run without one too, but an NVD key raises their rate limits, and some of their tools need keys for other feeds.

What do KEV and EPSS add to a CVSS score?

CVSS rates how bad a flaw could be. CISA KEV says it is being exploited now, and FIRST EPSS gives the chance of exploitation in the next 30 days. Together they help you fix the urgent few first.

Can a CVE tool tell if my code is affected?

Not from a CVE id alone. Reachability needs your code or dependency graph, which Snyk and similar scanners read. A CVE lookup tells you how risky the flaw is in general.

Other comparisons

• Email DNS check tools compared
• Travel advisory and airport delay tools compared
• Software end-of-life tools compared
• AI crawler audit tools compared
• Recall check tools compared
• HS code and tariff tools compared

OpenKrill builds live-data tools for AI agents, with a human check on the result.