Home/cisa-cybersecurity-mcp-server
Hybrid

cisa-cybersecurity-mcp-server

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

io.github.cyanheads/cisa-cybersecurity-mcp-serverSource repository
Version0.4.0latest catalog version
ConnectionHybridstreamable-http · npm
PublishedNov 01, 2026catalog
UpdatedNov 01, 2026catalog
Overview

What this server provides

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Connect

Remote endpoints

1
Remote endpoint 1streamable-http
https://cisa-cybersecurity.caseyjhand.com/mcp
Open endpoint
Install

Packages

2
Package 1npm
@cyanheads/cisa-cybersecurity-mcp-server0.4.0
Runtime npxTransport stdio
  • CISA_CLAMP_OVERSIZED_INPUTS

    Return bounded results and explicit unprocessed CVE IDs for oversized reads. Set false to reject requests above each tool's workload cap.

    Format: string · Default: true
    Optional
  • MCP_LOG_LEVEL

    Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

    Format: string · Default: info
    Optional
  • CISA_KEV_REFRESH_CRON

    Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.

    Format: string · Default: */30 * * * *
    Optional
  • CISA_CSAF_MIRROR_PATH

    Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.

    Format: string
    Optional
  • CISA_CSAF_MIRROR_AUTO_INIT

    Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.

    Format: string · Default: true
    Optional
  • CISA_CSAF_REFRESH_CRON

    Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.

    Format: string · Default: 17 */6 * * *
    Optional
  • CISA_VULNRICHMENT_CACHE_TTL_SECONDS

    Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.

    Format: string · Default: 21600
    Optional
  • CISA_FEED_CACHE_TTL_SECONDS

    Seconds a parsed RSS feed window stays cached.

    Format: string · Default: 900
    Optional
  • CISA_HTTP_TIMEOUT_MS

    Per-request timeout in milliseconds for every upstream fetch.

    Format: string · Default: 30000
    Optional
Package 2npm
@cyanheads/cisa-cybersecurity-mcp-server0.4.0
Runtime npxTransport streamable-http
http://localhost:3010/mcp
  • CISA_CLAMP_OVERSIZED_INPUTS

    Return bounded results and explicit unprocessed CVE IDs for oversized reads. Set false to reject requests above each tool's workload cap.

    Format: string · Default: true
    Optional
  • MCP_HTTP_HOST

    The hostname for the HTTP server.

    Format: string · Default: 127.0.0.1
    Optional
  • MCP_HTTP_PORT

    The port to run the HTTP server on.

    Format: string · Default: 3010
    Optional
  • MCP_HTTP_ENDPOINT_PATH

    The endpoint path for the MCP server.

    Format: string · Default: /mcp
    Optional
  • MCP_AUTH_MODE

    Authentication mode to use: 'none', 'jwt', or 'oauth'.

    Format: string · Default: none
    Optional
  • MCP_LOG_LEVEL

    Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

    Format: string · Default: info
    Optional
  • CISA_KEV_REFRESH_CRON

    Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.

    Format: string · Default: */30 * * * *
    Optional
  • CISA_CSAF_MIRROR_PATH

    Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.

    Format: string
    Optional
  • CISA_CSAF_MIRROR_AUTO_INIT

    Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.

    Format: string · Default: true
    Optional
  • CISA_CSAF_REFRESH_CRON

    Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.

    Format: string · Default: 17 */6 * * *
    Optional
  • CISA_VULNRICHMENT_CACHE_TTL_SECONDS

    Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.

    Format: string · Default: 21600
    Optional
  • CISA_FEED_CACHE_TTL_SECONDS

    Seconds a parsed RSS feed window stays cached.

    Format: string · Default: 900
    Optional
  • CISA_HTTP_TIMEOUT_MS

    Per-request timeout in milliseconds for every upstream fetch.

    Format: string · Default: 30000
    Optional
View server metadata