CVE Risk Check in Claude
CVE severity and exploit risk. The MCP server is https://cve.openkrill.app/mcp. No key. The steps below are only for Claude. A call to check_cve was checked against that server on 2026-10-01.
What this server answers
Triage a security vulnerability by its CVE id: how severe it is, whether it is being exploited, and how likely exploitation is.
Ask "how bad is CVE-2021-44228?", "which of these CVEs should I patch first?" or "what did CISA add to its exploited list this month?".
CVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CISA Known Exploited Vulnerabilities (KEV) catalog lists the CVE, with CISA's due date and required action. FIRST's EPSS gives the modelled probability that the CVE is exploited in the next 30 days.
Each CVE gets a priority: "exploited" when CISA lists it, "likely" when its EPSS score is 0.1 or more, otherwise "routine", or "unknown" when EPSS could not be read. A batch of up to 10 CVEs comes back sorted with the most urgent first.
Every answer names its sources and the date the NVD record and the EPSS score are from. NVD limits requests without a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry.
It looks up CVE ids. It does not scan your systems, find which packages or versions are affected (use Package Health Check for that), confirm that you are vulnerable, or tell you how to exploit anything. The ids you ask about are not stored; the only lasting record is a daily count of calls per tool.
What it can do
- Looks up a CVE's description, CVSS score and severity, and publication date from the NVD
- Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action
- Adds the EPSS score: the modelled chance of exploitation in the next 30 days
- Gives each CVE a priority: exploited, likely or routine
- Ranks a batch of up to 10 CVEs with the most urgent first
- Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word
- Links a patch or vendor advisory when NVD tags one, and names its sources and dates
Tools
check_cve, Check a CVE. Use this when the user asks how serious a CVE is, such as "how bad is CVE-2021-44228?". Pass the CVE id. Returns a priority (exploited, likely, routine or unknown), the description, CVSS score and severity, whether the CISA Known Exploited Vulnerabilities catalog lists it, the EPSS exploitation probability, a patch or advisory link when tagged, and the as_of dates. A lookup by CVE id: it does not know which software the user runs or whether they are affected.check_cves, Rank several CVEs. Use this when the user has a list of CVE ids and wants to know which to deal with first, such as "which of these CVEs should I patch first?". Pass up to 10 CVE ids. Returns each one's priority, CVSS score, CISA exploited-list status and EPSS score, most urgent first, with a count per priority. An id NVD could not be asked about in this call is marked deferred; ask for it again later. It does not know which software the user runs.list_recent_kev, List recent exploited CVEs. Use this when the user asks what CISA recently added to its Known Exploited Vulnerabilities list, such as "what exploited CVEs were added this month?". Optionally pass how many days back (up to 90), a product word to filter by, and a limit. Returns each CVE with its CISA name, the date it was added, CISA's due date and its CVSS score, newest first. The catalog lists vulnerabilities with evidence of exploitation; it is not a list of every serious CVE.
Add CVE Risk Check in Claude
Claude connects to a remote MCP server as a custom connector. The connection is made from Anthropic's cloud, not from your laptop, so the server must be on the public internet. CVE Risk Check is. These steps were checked against Claude's custom-connector article (updated 2026-08-11) and the Claude Code MCP docs on 2026-10-01.
On a Pro or Max plan:
- Open Customize, then Connectors.
- Select the plus button, then Add custom connector.
- Paste
https://cve.openkrill.app/mcp. Leave Advanced settings empty: this server does not need an OAuth client id or secret. - Select Add. The connector is yours. Anthropic has not reviewed it, and it is not a Directory listing.
- In a conversation, open the plus button, then Connectors, and enable CVE Risk Check. Ask: How bad is CVE-2021-44228?
On Team and Enterprise, an Owner adds the connector first at Organization settings, then Connectors, then Add, then Custom, then Web, and pastes the same URL. Members then connect it from Customize. A Free plan can add one custom connector.
In Claude Code, add it from the project directory:
claude mcp add --transport http cve https://cve.openkrill.app/mcpThat writes a local or user config. A JSON entry needs "type": "http" (or streamable-http) plus the url. An entry with a url and no type is skipped. Confirm with claude mcp get cve. The tools you should see are check_cve, check_cves, list_recent_kev.
Enable the connector only in conversations that need it. Claude can call the tools while you work, including during research, so turn off any tool you do not want invoked. CVE Risk Check does not write to your accounts. It still receives the arguments of each call. Read the privacy page before you paste anything that is not public.
A call checked on 2026-10-01
CVE-2021-44228 is Log4Shell, listed by CISA, so priority, CVSS and KEV can be checked against the public record. The request below was posted to https://cve.openkrill.app/mcp as tools/call. HTTP 200. Source: the CVE Risk Check server, read 2026-10-01.
{
"method": "tools/call",
"params": {
"name": "check_cve",
"arguments": {
"cve": "CVE-2021-44228"
}
}
}- status. ok
- priority. exploited
- cve. CVE-2021-44228
- source. NVD (nvd.nist.gov, includes the CISA Known Exploited Vulnerabilities flag) and FIRST EPSS (first.org)
- notice. Priority is a triage hint, not a risk rating: exploited means CISA lists it as exploited in the wild, likely means an EPSS score of 0.1 or more, routine is anything lower. To check whether a package version is affected,
- kev name. Apache Log4j2 Remote Code Execution Vulnerability
Repeat the call yourself if you need a newer reading. Cached answers expire. A rate limit is not a result: wait and try again. Nothing in the call is a ranking, a filing, or advice.