CISA KEV and EPSS in your AI assistant: a free, read-only MCP server
Quick answer, Oct 28, 2026As of 28 October 2026, the Distributed Risk MCP server at https://www.distributedrisk.com/mcp lets an AI assistant search CISA's Known Exploited Vulnerabilities catalog. Each result gives the CVE, vendor, product, date added, federal due date, known ransomware use, required action and FIRST's EPSS estimate. It is read-only and needs no key.
Connect it
Claude Code:
claude mcp add --transport http distributed-risk https://www.distributedrisk.com/mcp
For clients that read an mcpServers file, add "distributed-risk": { "type": "http", "url": "https://www.distributedrisk.com/mcp" }. The server speaks Streamable HTTP, needs no key, and every tool only reads. Setup details are on the AI access page.
What search_kev returns
CISA's catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether the product sits in the AI and agent software stack. You can look up one CVE, search vendor or product words, list what was added since a date, or filter to the AI stack only.
For one CVE in full, get_cve joins the CVE.org record, CISA's exploitation call (SSVC) and KEV listing with the federal due date, FIRST's EPSS estimate, and the AI-stack flag. Each source is dated in the answer.
Freshness
The catalogs are read again every hour. Official sources are labelled as official; EPSS is labelled as a model's estimate, not a government finding.
Read the desk notes
Each KEV addition that matters gets a numbered, dated desk note with the official record, an assessment for the reader it is written for, what would change the call, and numbered sources. Filter the desk by the reader that is you, such as a cyber underwriter or a platform owner.
Limits
KEV lists vulnerabilities with evidence of exploitation, not every vulnerability; EPSS estimates likelihood. Read them together (see KEV vs EPSS). The server reads the public record; matching it to what you run is your work.
Questions
Is there a cost or an API key? No key is needed. One address can make about 120 calls a minute.
Where does the data come from? CISA's KEV catalog and advisories, CVE.org, and FIRST's EPSS. See the method.