io.github.cyanheads/cisa-cybersecurity-mcp-server
REMOTE · CISA-CYBERSECURITY.CASEYJHAND.COM · 2 COMPONENTS
CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.
Last scanned (17 hours ago)
Scores higher than 98% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability82
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 9044 tokens (~133/item across 68 items; 7 tools + 61 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Resource “CVE-2021-3199 — ONLYOFFICE Docs Server Path Traversal Vulnerability” was removed ▼ functional
- New resource “CVE-2024-27834 — Apple Multiple Products Improper Authentication Vulnerability” functional
- 4 Nov 26 0
- Resource “CVE-2016-3081 — Apache Struts Command Injection Vulnerability” was removed ▼ functional
- Resource “ICSA-26-293-01 — HMS Networks PEAK-System PCAN Windows drivers” was removed ▼ functional
- New resource “ICSA-26-307-01 — Subnet Solutions PowerSYSTEM Center” functional
- New resource “CVE-2026-119977 — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability” functional
- 1 Nov 26 0
- Tool “cisa_get_alerts” rewrote its description, which is the text the model reads security
- Tool “cisa_get_advisory” rewrote its description, which is the text the model reads security
- New resource “cisa-cybersecurity-guide” functional
- Server version: 0.3.2 → 0.4.0 functional
- “cisa_get_alerts” added an optional parameter “cursor” cosmetic
- “cisa_get_ssvc” reworded the description of “cveIds” cosmetic
- “cisa_search_kev” reworded the description of “limit” cosmetic
- “cisa_search_ics_advisories” reworded the description of “limit” cosmetic
- “cisa_get_alerts” reworded the description of “limit” cosmetic
- “cisa_get_advisory” reworded the description of “productIds” cosmetic
- “cisa_check_cve_status” reworded the description of “cveIds” cosmetic
- 31 Oct 26 0
- Resource “CVE-2015-5477 — ISC BIND Data Processing Errors Vulnerability” was removed ▼ functional
- Resource “CVE-2015-3306 — ProFTPD Improper Access Control Vulnerability” was removed ▼ functional
- New resource “CVE-2026-111357 — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability” functional
- New resource “CVE-2026-118527 — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability” functional
- 30 Oct 26 0
- Resource “CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability” was removed ▼ functional
- Resource “CVE-2026-102490 — Zammad GmbH Zammad Improper Privilege Management Vulnerability” was removed ▼ functional
- Resource “ICSA-26-293-05 — Hitachi Energy RTU500 Product” was removed ▼ functional
- Resource “ICSA-26-293-04 — Hitachi Energy MicroSCADA X SYS600 Product” was removed ▼ functional
- Resource “ICSA-26-293-03 — Moxa AIG-302 ThingsPro Edge” was removed ▼ functional
- Resource “ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud” was removed ▼ functional
- Resource “ICSA-26-288-01 — Eclipse Foundation Eclipse Milo” was removed ▼ functional
- Resource “ICSA-26-062-03 — Hitachi Energy RTU500 Product (Update A)” was removed ▼ functional
- New resource “CVE-2026-97229 — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability” functional
- New resource “CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability” functional
- New resource “ICSA-26-258-06 — Siemens Mendix SAML” functional
- New resource “ICSA-26-125-01 — Hitachi Energy PCM600 (Update A)” functional
- New resource “ICSA-25-275-02 — Hitachi Energy MSM Product (Update A)” functional
- New resource “ICSA-26-302-02 — Hitachi Energy TRO600 series products” functional
- New resource “ICSA-26-302-03 — Hitachi Energy CoreTec Product” functional
- New resource “ICSA-26-302-01 — Siemens Mendix SAML Module” functional
- 29 Oct 26 0
- Resource “ICSMA-26-288-01 — Thermo Fisher Torrent Suite Software” was removed ▼ functional
- Resource “ICSMA-26-288-02 — J4Care dcm4che” was removed ▼ functional
- Resource “CVE-2026-102489 — Zammad GmbH Zammad Session Fixation Vulnerability” was removed ▼ functional
- Resource “ICSA-26-281-01 — Red Lion Controls N-Tron 700 Series - Update A” was removed ▼ functional
- Resource “CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability” was removed ▼ functional
- New resource “ICSA-26-300-02 — Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz” functional
- New resource “ICSA-26-300-01 — EPICS Base” functional
- New resource “ICSA-26-267-02 — Eufy Omni C20, Omni X10 Pro (Update A)” functional
- New resource “CVE-2026-46300 — Linux Kernel Missing Initialization of a Variable Vulnerability” functional
- New resource “CVE-2026-41709 — Broadcom VMWare ESX Insufficient Logging Vulnerability” functional
- 28 Oct 26 0
- Resource “CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability” was removed ▼ functional
- Resource “CVE-2026-86950 — Apple Multiple Products Out-of-Bounds Write Vulnerability” was removed ▼ functional
- New resource “CVE-2026-111497 — Google Brotli Unchecked Return Value Vulnerability” functional
- New resource “CVE-2026-48356 — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability” functional
- 27 Oct 26 0
- Resource “CVE-2026-88772 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability” was removed ▼ functional
- Resource “CVE-2026-88771 — Citrix NetScaler Improper Input Validation Vulnerability” was removed ▼ functional
- New resource “CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability” functional
- New resource “CVE-2026-109618 — PHP Memory Corruption Vulnerability” functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://cisa-cybersecurity.caseyjhand.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=caseyjhand.com | CN=WE1,O=Google Trust Services,C=US | 2 Nov 2026 | 31 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 995a30681ab772540e934241ca1d576c |
| SANs: caseyjhand.com, *.caseyjhand.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of cisa-cybersecurity.caseyjhand.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| com. | DS published | 19718 | 13 | Verified |
| caseyjhand.com. | DS published | 2371 | 13 | Verified |
| cisa-cybersecurity.caseyjhand.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cisa-cybersecurity.caseyjhand.com/mcp | Verified | 200 | |
| http (plaintext) | http://cisa-cybersecurity.caseyjhand.com/mcp | HTTPS enforced | 301 | https://cisa-cybersecurity.caseyjhand.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cisa_check_cve_status ~440
Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
| Name | Type | Req | Description |
|---|---|---|---|
| cveIds | array | yes | CVE identifiers to check, up to 1,000 accepted and 200 processed per call. Oversized batches return normalized unprocessedIds for a follow-up call unless normalization is disabled. The whole batch co… |
| detail | string | – | full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensi… |
| Name | Type | Req | Description |
|---|---|---|---|
| asOf | string | – | The UTC date daysUntilDue and overdue were computed against, YYYY-MM-DD. |
| catalog | object | – | Which catalog snapshot answered this call. |
| error | object | – | Present when the call failed. Absent on success. |
| foundCount | integer | – | How many of the requested CVEs are in the catalog. |
| notFoundCount | integer | – | How many of the requested CVEs are not in the catalog. |
| notice | string | – | Guidance when none of the supplied CVE IDs are in the catalog. |
| results | array | – | One result per processed CVE, in the order supplied. |
| summaryNote | string | – | Present only under detail "summary": which fields each in-KEV result omits and how to restore them. |
| unprocessedIds | array | – | Normalized CVE IDs not processed; send these in a follow-up call. |
No examples provided.
cisa_get_advisory ~321
Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, remediations, flags, or threats. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.
| Name | Type | Req | Description |
|---|---|---|---|
| advisoryId | string | yes | Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized. |
| cves | array | – | Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include "vulnerabiliti… |
| productIds | array | – | Narrow products to these IDs from vulnerability status, score, remediation, flag, or threat references. Alone selects products; combined with cves selects both sections. Explicit sections must includ… |
| sections | array | – | Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget. |
| Name | Type | Req | Description |
|---|---|---|---|
| acknowledgments | array | – | Acknowledgment entries. |
| advisory | object | – | Advisory identity, dates, and attribution. Always kept, including on a section selection. |
| error | object | – | Present when the call failed. Absent on success. |
| found | boolean | – | Whether an advisory with that ID is in the index. |
| guidance | string | – | What to do instead, present when found is false: how current the index is, and whether the advisory may be newer than it. |
| indexCheckpoint | string|null | – | Present when found is false: the newest revision timestamp the index holds, or null if none. |
| indexLastSyncedAt | string|null | – | Present when found is false: when the index last completed a sync, ISO 8601, or null if never. |
| kind | string | – | full when the document is returned; outline when only the section listing is. |
| outlineNotice | string | – | Outline arm — how to call cisa_get_advisory for specific sections. |
| products | object | – | Affected products and version ranges. |
| references | array | – | Document-level references. |
| revisionHistory | array | – | Revision history, oldest first as published. |
| sections | array | – | Outline arm — the sections available, largest first, with their byte sizes and, for vulnerabilities, its CVE IDs. |
| summary | object | – | Narrative notes and sector classification. |
| vulnerabilities | array | – | Vulnerabilities the advisory covers, with scores, remediations, and product status. |
No examples provided.
cisa_get_alerts ~251
List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Cursors continue within the current 30-item rolling window; upstream provides no pagination, history, or date-range query. The window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque continuation cursor from this feed. Resumes after the last returned GUID within the available window; omit to restart. |
| feed | string | – | Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks). |
| limit | integer | – | Maximum items to return; values above 30 use 30 when input clamping is enabled. The upstream window contains at most 30 items. |
| since | string | – | Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it. |
| Name | Type | Req | Description |
|---|---|---|---|
| cap | integer | – | The limit that was applied. |
| cursor | string | – | Continuation cursor for this feed; absent on the last page or when the anchor is unavailable. |
| effectiveQuery | string | – | The since filter as applied, and how many window items it excluded. |
| error | object | – | Present when the call failed. Absent on success. |
| feed | string | – | The feed that was read. |
| feedTitle | string | – | The channel title the feed declares. |
| feedUrl | string | – | The absolute feed URL this window came from. |
| fetchedAt | string | – | UTC timestamp when this window was successfully fetched. |
| hasMore | boolean | – | Whether more matching items remain after this page within the available window. |
| items | array | – | Items from the fetched window, newest first as published; stale identifies cached fallback. |
| notice | string | – | Safe retry guidance on refresh failure, or guidance when the since filter excluded every item. |
| shown | integer | – | Items returned. |
| stale | boolean | – | True when refresh failed and this response uses the last cached window. |
| truncated | boolean | – | True when the limit capped the returned items. |
| window | object | – | What the fetched window covers. |
| windowCaveat | string | – | Limits of continuation within the upstream rolling window. |
No examples provided.
cisa_get_ssvc ~287
Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.
| Name | Type | Req | Description |
|---|---|---|---|
| assetExposure | string | – | Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. "unknown" returns both arms so the spread… |
| cveIds | array | yes | CVE identifiers to look up, up to 1,000 accepted and 50 processed per call. Oversized batches return normalized unprocessedIds for a follow-up call unless normalization is disabled. Each uncached CVE… |
| Name | Type | Req | Description |
|---|---|---|---|
| echo | object | – | The request as the server parsed it. |
| error | object | – | Present when the call failed. Absent on success. |
| failedCount | integer | – | How many processed CVE lookups failed; absence is unknown. |
| foundCount | integer | – | How many CVEs carry published SSVC decision points. |
| notFoundCount | integer | – | How many processed CVEs have confirmed absence of SSVC decision points. |
| notice | string | – | Guidance when nothing was enriched, or when a decision timestamp predates KEV. |
| results | array | – | One result per processed CVE, in the order supplied. |
| unprocessedIds | array | – | Normalized CVE IDs not processed; send these in a follow-up call. |
No examples provided.
cisa_list_reference ~176
Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently hold… |
| Name | Type | Req | Description |
|---|---|---|---|
| definitions | array | – | Topic directives only — supporting definitions from the directive text. |
| entries | array | – | The decoded terms for this topic. |
| error | object | – | Present when the call failed. Absent on success. |
| sources | object | – | Topic sources only — what this server currently holds, read from in-process state. |
| summary | string | – | What this topic covers and when to reach for it. |
| supersedes | array | – | Topic directives only — the directives BOD 26-04 supersedes and revokes. |
| timelineTable | array | – | Topic directives only — all sixteen rows of BOD 26-04 Appendix A, Table 1. |
| title | string | – | Human-readable title for the topic. |
| topic | string | – | The topic that was decoded. |
No examples provided.
cisa_search_ics_advisories ~769
Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor from a previous call. Omit for the first page. |
| cve | string | – | Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized. |
| cvssMax | number | – | Maximum value of the advisory's maximum CVSS base score, inclusive. |
| cvssMin | number | – | Minimum value of the advisory's maximum CVSS base score, inclusive. |
| cwe | string | – | Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children. |
| inKev | boolean | – | true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only t… |
| limit | integer | – | Maximum advisories per page; requests above 50 use 50 when input clamping is enabled. |
| order | string | – | Sort direction. Under relevance, desc means most relevant first. |
| product | string | – | Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters. |
| publishedFrom | string | – | Earliest initial release date, inclusive, YYYY-MM-DD. |
| publishedTo | string | – | Latest initial release date, inclusive, YYYY-MM-DD. |
| publisher | string | – | coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus. |
| q | string | – | Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit i… |
| revisedFrom | string | – | Earliest current release date, inclusive, YYYY-MM-DD. |
| revisedTo | string | – | Latest current release date, inclusive, YYYY-MM-DD. |
| sector | string | – | Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors. |
| series | string | – | Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus. |
| severity | string | – | Severity band of the advisory's maximum CVSS score. |
| sortBy | string | – | Field to sort by. relevance requires q and ranks by FTS5 bm25. |
| vendor | string | – | Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this… |
| Name | Type | Req | Description |
|---|---|---|---|
| appliedFilters | object | – | The filters the server actually applied. |
| cap | integer | – | The page limit that was applied. |
| cursor | string | – | Opaque cursor for the next page. Absent when this is the last page. |
| cvssCoverage | string | – | Disclosure of derived-band and no-score coverage under a score filter. |
| error | object | – | Present when the call failed. Absent on success. |
| hasMore | boolean | – | Whether more matches exist beyond this page. |
| mirror | object | – | Which index state answered this call. |
| notice | string | – | Guidance when nothing matched — the filter that matches no advisory on its own and what dropping it restores, or the filters whose removal restores results and how many — when a page was capped, when… |
| results | array | – | Matching advisories for this page. |
| sectorCoverage | string | – | Disclosure of how many advisories a sector filter can never match. |
| shown | integer | – | Advisories returned on this page. |
| totalCount | integer | – | Total matches before paging. |
| truncated | boolean | – | True when the page limit capped this result. |
No examples provided.
cisa_search_kev ~610
Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque pagination cursor from a previous call. Omit for the first page. |
| cveIdPrefix | string | – | Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized. |
| cwe | string | – | Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match. |
| dateAddedFrom | string | – | Earliest date added, inclusive, YYYY-MM-DD. |
| dateAddedTo | string | – | Latest date added, inclusive, YYYY-MM-DD. |
| directive | string | – | Which directive the entry cites. "none" selects the entries citing neither. |
| dueAfter | string | – | Earliest due date, inclusive, YYYY-MM-DD. |
| dueBefore | string | – | Latest due date, inclusive, YYYY-MM-DD. |
| forensicTriage | boolean | – | True selects the BOD 26-04 three-day forensic-triage tier. |
| limit | integer | – | Maximum entries per page; requests above 100 use 100 when input clamping is enabled. |
| nameContains | string | – | Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and k… |
| order | string | – | Sort direction. |
| overdue | boolean | – | True selects entries whose due date is strictly before the echoed asOf date. |
| product | string | – | Case-insensitive substring of CISA's own product label. |
| ransomware | boolean | – | True selects entries CISA has linked to ransomware campaigns. |
| sortBy | string | – | Field to sort by. |
| vendorProject | string | – | Case-insensitive substring of CISA's own vendor label. |
| Name | Type | Req | Description |
|---|---|---|---|
| appliedFilters | object | – | The filters the server actually applied, as it parsed them. |
| asOf | string | – | The UTC date overdue and daysUntilDue were computed against, YYYY-MM-DD. |
| cap | integer | – | The page limit that was applied. |
| catalog | object | – | Which catalog snapshot answered this call. |
| cursor | string | – | Opaque cursor for the next page. Absent when this is the last page. |
| error | object | – | Present when the call failed. Absent on success. |
| hasMore | boolean | – | Whether more matches exist beyond this page. |
| notice | string | – | Guidance when nothing matched, when a page was capped, or when nameContains dropped characters it cannot match. |
| results | array | – | Matching KEV entries for this page. |
| shown | integer | – | Entries returned on this page. |
| snapshotCaveat | string | – | Disclosure that additions are queryable but revisions are not detectable. |
| totalCount | integer | – | Total matches before paging. |
| truncated | boolean | – | True when the page limit capped this result. |
No examples provided.
How do I install the io.github.cyanheads/cisa-cybersecurity-mcp-server server?
io.github.cyanheads/cisa-cybersecurity-mcp-server is a hosted endpoint at https://cisa-cybersecurity.caseyjhand.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cisa-cybersecurity.caseyjhand.com
claude mcp add --transport http cyanheads-cisa-cybersecurity-mcp-server 'https://cisa-cybersecurity.caseyjhand.com/mcp'
What is the io.github.cyanheads/cisa-cybersecurity-mcp-server server?
io.github.cyanheads/cisa-cybersecurity-mcp-server is listed in the public MCP registry as io.github.cyanheads/cisa-cybersecurity-mcp-server. CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless. This page covers its hosted endpoint (https://cisa-cybersecurity.caseyjhand.com/mcp).
Is the io.github.cyanheads/cisa-cybersecurity-mcp-server server safe to use?
io.github.cyanheads/cisa-cybersecurity-mcp-server scores 90 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cyanheads/cisa-cybersecurity-mcp-server server expose?
io.github.cyanheads/cisa-cybersecurity-mcp-server exposes 7 tools: cisa_list_reference, cisa_check_cve_status, cisa_search_kev, cisa_get_ssvc, cisa_search_ics_advisories, and 2 more. Their descriptions and schemas cost roughly 2,854 tokens of context every time the server is loaded.
Does the io.github.cyanheads/cisa-cybersecurity-mcp-server server require authentication?
No. We connected to io.github.cyanheads/cisa-cybersecurity-mcp-server without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.cyanheads/cisa-cybersecurity-mcp-server server still maintained?
io.github.cyanheads/cisa-cybersecurity-mcp-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the io.github.cyanheads/cisa-cybersecurity-mcp-server server?
VerifyMCP ran 13 checks on io.github.cyanheads/cisa-cybersecurity-mcp-server, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.