# Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database (remote · mcp.exploit-intel.com)

Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)

- Trust score: 76/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.exploit-intel.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp.md), [page](https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp)
- pypi · `eip-mcp`: 5/100, [markdown](https://verifymcp.io/servers/com-exploit-intel-eip-mcp/eip-mcp.md), [page](https://verifymcp.io/servers/com-exploit-intel-eip-mcp/eip-mcp)

## Channel facts

- Endpoint: `https://mcp.exploit-intel.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.3.9`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 76/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3631 tokens (~213/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-exploit-intel-eip-mcp https://mcp.exploit-intel.com/mcp
```

### Codex

```toml
[mcp_servers.com-exploit-intel-eip-mcp]
url = "https://mcp.exploit-intel.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-exploit-intel-eip-mcp": {
      "type": "remote",
      "url": "https://mcp.exploit-intel.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-exploit-intel-eip-mcp --url https://mcp.exploit-intel.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-exploit-intel-eip-mcp:
    url: "https://mcp.exploit-intel.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-exploit-intel-eip-mcp": {
      "type": "http",
      "url": "https://mcp.exploit-intel.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 75, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 72, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 70, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 69)

First indexed and scored.

## MCP tools (17)

### `search_vulnerabilities` (~594 tokens)

Search Vulnerabilities

Search the Exploit Intelligence Platform for vulnerabilities (CVEs). Returns a list of matching CVEs with CVSS scores, EPSS exploitation probability, exploit counts, CISA KEV status, VulnCheck KEV, InTheWild.io exploitation signals, and ransomware attribution. Supports full-text search, severity/vendor/product/ecosystem/CWE filters, CVSS/EPSS thresholds, plus any_exploited and ransomware filters. When sort is omitted, the API may automatically prefer newest exploitation, exploit, or nuclei-template activity based on the filters you set. Examples: query='apache httpd' with has_exploits=true; vendor='fortinet' with severity='critical' and is_kev=true sorted by epss_desc; any_exploited=true with ransomware=true for ransomware-linked CVEs; cwe='89' with min_cvss=9 for critical SQL injection CVEs.

Input parameters:

- `any_exploited` (boolean): Only return CVEs exploited in the wild (CISA KEV + VulnCheck KEV + InTheWild.io)
- `cwe` (string): Filter by CWE ID (e.g. '79' or 'CWE-79')
- `date_from` (string): Start date for CVE publication (YYYY-MM-DD)
- `date_to` (string): End date for CVE publication (YYYY-MM-DD)
- `ecosystem` (string): Filter by package ecosystem
- `has_exploits` (boolean): Only return CVEs with public exploit code
- `has_nuclei` (boolean): Only return CVEs with Nuclei scanner templates
- `is_kev` (boolean): Only return CISA Known Exploited Vulnerabilities
- `min_cvss` (number): Minimum CVSS v3 score (0-10)
- `min_epss` (number): Minimum EPSS score (0-1)
- `min_score` (number): Minimum score for the selected score_version (0-10)
- `page` (integer): Page number (default: 1)
- `per_page` (integer): Results per page (1-25, default: 10)
- `product` (string): Filter by product name (e.g. 'exchange', 'pan-os')
- `query` (string): Search keywords (e.g. 'apache httpd', 'log4j'). Optional if filters are provided.
- `ransomware` (boolean): Only return CVEs with confirmed ransomware campaign use
- `score_version` (string): Score family for min_score / score_desc
- `severity` (string): Filter by severity level
- `sort` (string): Sort order. Aliases are normalized to the current server schema.
- `vendor` (string): Filter by vendor name (e.g. 'microsoft', 'fortinet')
- `year` (integer): Filter by CVE year (e.g. 2024)

### `get_vulnerability` (~205 tokens)

Get Vulnerability Detail

Get a full intelligence brief for a specific vulnerability. Accepts both CVE-IDs (e.g. CVE-2024-3400) and EIP-IDs (e.g. EIP-2026-12345 for pre-CVE entries). Returns detailed information including CVSS score and vector, EPSS exploitation probability, CISA KEV status, description, affected products, ranked exploits (grouped by Metasploit modules, verified ExploitDB, GitHub PoCs, and trojans), Nuclei scanner templates with recon dorks, alternate identifiers, and references. Exploits are ranked by quality: Metasploit modules first (peer-reviewed), then verified ExploitDB, then GitHub by stars. Trojans are flagged at the bottom.

Input parameters:

- `cve_id` (string, required): CVE or EIP identifier (e.g. 'CVE-2024-3400' or 'EIP-2026-12345')

### `get_exploit_code` (~156 tokens)

Get Exploit Source Code

Retrieve the source code of a specific exploit by its platform ID. IMPORTANT: Use the platform's internal ID shown as [id=XXXXX] in results, NOT the ExploitDB number (EDB-XXXXX). These are different numbering systems. Returns code from the exploit archive. If no file_path is specified, auto-selects the most relevant code file. Use this to analyze exploit mechanics, understand attack techniques, or review PoC code.

Input parameters:

- `exploit_id` (integer, required): Platform exploit ID (the [id=XXXXX] number from results — NOT the EDB number)
- `file_path` (string): Relative path inside the exploit archive (optional — auto-selects if omitted). Absolute paths and traversal patterns are rejected.

### `get_exploit_analysis` (~153 tokens)

Get Exploit AI Analysis

Get the full AI analysis for a single exploit by its platform ID. Returns classification (working_poc, trojan, suspicious, scanner, stub, writeup), attack type, complexity, reliability, confidence score, authentication requirements, target software, a summary of what the exploit does, prerequisites, MITRE ATT&CK techniques, deception indicators for trojans, and the standalone backdoor-review verdict with operator-risk notes when available. Use this to check if an exploit is safe before reviewing its code. Example: exploit_id=61514 returns a TROJAN warning with deception indicators.

Input parameters:

- `exploit_id` (integer, required): Platform exploit ID (the [id=XXXXX] number from results — NOT the EDB number)

### `get_nuclei_templates` (~104 tokens)

Get Nuclei Templates

Get Nuclei scanner templates and recon dorks for a vulnerability. Returns template metadata, severity, verification status, tags, and ready-to-use Shodan, FOFA, and Google dork queries for target identification. Accepts both CVE-IDs and EIP-IDs. Use this to plan scanning or reconnaissance.

Input parameters:

- `cve_id` (string, required): CVE or EIP identifier (e.g. 'CVE-2024-27198')

### `get_platform_stats` (~49 tokens)

Get Platform Statistics

Get platform-wide statistics from the Exploit Intelligence Platform. Returns total counts of vulnerabilities, exploits, KEV entries, Nuclei templates, vendors, and authors, plus the last data update timestamp.

### `check_health` (~54 tokens)

Check API Health

Check the EIP API health and data freshness. Returns database status and timestamps for each of the 10 ingestion sources (NVD, KEV, EPSS, ExploitDB, GitHub, Metasploit, etc.).

### `search_exploits` (~561 tokens)

Search Exploits

Browse and filter exploits using STRUCTURED FILTERS ONLY (no free-text query). Use this to filter by source (github, metasploit, exploitdb, nomisec, gitlab, inthewild, vulncheck_xdb, patchapalooza, oscs, poc_monitor), language (python, ruby, etc.), LLM classification (working_poc, trojan, suspicious, scanner, stub, writeup, tool, no_code), author, min stars, code availability, CVE ID, vendor, or product. Also filter by AI analysis: attack_type (RCE, SQLi, XSS, DoS, LPE, auth_bypass, info_leak), complexity (trivial/simple/moderate/complex), reliability (reliable/unreliable/untested/theoretical), requires_auth. NOTE: To search by product name (e.g. 'OpenSSH', 'Apache'), use search_vulnerabilities instead — it has free-text query and get_vulnerability already includes exploits in the response. Examples: source='metasploit' for all Metasploit modules; attack_type='RCE' with reliability='reliable' for weaponizable RCE exploits; cve='CVE-2024-3400' for all exploits targeting a specific CVE; vendor='mitel' for all Mitel exploits.

Input parameters:

- `attack_type` (string): Filter by attack type from AI analysis (case-insensitive on input; canonical casing returned)
- `author` (string): Filter by author name
- `complexity` (string): Filter by exploit complexity
- `cve` (string): Filter by CVE ID (e.g. 'CVE-2024-3400') — returns all exploits for that CVE
- `has_code` (boolean): Only exploits with downloadable code
- `language` (string): Filter by language: python, ruby, go, c, etc.
- `llm_classification` (string): Filter by LLM classification
- `min_stars` (integer): Minimum GitHub stars
- `page` (integer): Page number (default: 1)
- `per_page` (integer): Results per page (1-25, default: 10)
- `product` (string): Filter by product name (e.g. 'micollab', 'pan-os')
- `reliability` (string): Filter by exploit reliability
- `requires_auth` (boolean): Filter by whether exploit requires authentication
- `sort` (string): Sort order
- `source` (string): Filter by source
- `vendor` (string): Filter by vendor name (e.g. 'mitel', 'fortinet') — returns exploits for all CVEs affecting that vendor

### `list_authors` (~87 tokens)

List Exploit Authors

List exploit authors/researchers ranked by exploit count. Returns the top security researchers with their exploit counts and handles. Use this when asked 'who are the top exploit authors?' or 'who writes the most exploits?'

Input parameters:

- `page` (integer): Page number (default: 1)
- `per_page` (integer): Results per page (1-50, default: 25)

### `get_author` (~84 tokens)

Get Author Profile

Get an exploit author's profile with all their exploits. Returns author name, handle, total exploit count, activity start date, and a paginated list of their exploits with CVE context. Use this when asked about a specific researcher like 'show me all exploits by Chocapikk'.

Input parameters:

- `author_name` (string, required): Author name (e.g. 'Chocapikk')

### `list_cwes` (~58 tokens)

List CWE Categories

List CWE (Common Weakness Enumeration) categories ranked by vulnerability count. Returns CWE IDs, names, short labels, exploit likelihood, and how many CVEs have that weakness. Use this when asked 'what are the most common vulnerability types?'

### `get_cwe` (~76 tokens)

Get CWE Detail

Get details for a specific CWE including full name, description, exploit likelihood, parent CWE, and total vulnerability count. Example: cwe_id='CWE-79' returns details about Cross-Site Scripting.

Input parameters:

- `cwe_id` (string, required): CWE identifier (e.g. 'CWE-79' or '79')

### `list_vendors` (~51 tokens)

List Vendors

List software vendors ranked by vulnerability count. Returns the top 200 vendors with their total CVE counts. Use this when asked 'which vendors have the most vulnerabilities?' or to understand the threat landscape by vendor.

### `list_products` (~107 tokens)

List Vendor Products

List products for a specific vendor with vulnerability counts. Use this to discover exact product names for filtering. Product names in the database use CPE conventions (e.g. 'exchange_server' not 'exchange', 'windows_10' not 'windows 10'). Example: vendor='microsoft' returns products like exchange_server, windows_10, office, edge_chromium.

Input parameters:

- `vendor` (string, required): Vendor name (e.g. 'microsoft', 'apache', 'fortinet')

### `lookup_alt_id` (~110 tokens)

Lookup Alternate ID

Look up a vulnerability by an alternate identifier such as an ExploitDB ID (EDB-XXXXX) or GitHub Security Advisory ID (GHSA-XXXXX). Returns the matching CVE-ID with basic severity info. Use this when you have an EDB number or GHSA ID and need to find the corresponding CVE.

Input parameters:

- `alt_id` (string, required): Alternate ID (e.g. 'EDB-48537', 'GHSA-jfh8-c2jp-5v3q')

### `audit_stack` (~157 tokens)

Audit Tech Stack

Audit a technology stack for exploitable vulnerabilities. Accepts a comma-separated list of technologies (max 5) and searches for critical/ high severity CVEs with public exploits for each one, sorted by EPSS exploitation probability. Use this when a user describes their infrastructure and wants to know what to patch first. Example: technologies='nginx, postgresql, node.js' returns a risk-sorted list of exploitable CVEs grouped by technology. Rate-limit cost: each technology requires up to 2 API calls; 5 technologies counts as up to 10 calls toward your rate limit.

Input parameters:

- `technologies` (string, required): Comma-separated list of technologies (e.g. 'nginx, postgresql, node.js'). Max 5.

### `generate_finding` (~186 tokens)

Generate Pentest Finding

Generate a pentest report finding in Markdown format for a specific vulnerability. Fetches full detail and formats it as a professional finding with severity, CVSS, description, affected products, exploit availability, and references. Accepts both CVE-IDs and EIP-IDs. Optionally include the target system tested and tester notes. The output is ready to paste into a pentest report. Example: cve_id='CVE-2024-3400', target='fw.corp.example.com', notes='Confirmed RCE via GlobalProtect gateway'.

Input parameters:

- `cve_id` (string, required): CVE or EIP identifier (e.g. 'CVE-2024-3400')
- `notes` (string): Tester notes to include in the finding. Optional.
- `target` (string): Target system tested (e.g. 'fw.corp.example.com'). Optional.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 76
- 2026-08-01: 75
- 2026-07-31: 75
- 2026-07-30: 72
- 2026-07-29: 71
- 2026-07-28: 70
- 2026-07-27: 70
- 2026-07-26: 69

## Links

- Remote endpoint: https://mcp.exploit-intel.com/mcp
- Website: https://exploit-intel.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-exploit-intel-eip-mcp/mcp