ZEN SecDB
ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.
Connect it
Settings → Connectors → Add custom connector
URL: https://secdb.nttzen.cloud/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://secdb.nttzen.cloud/mcp{
"mcpServers": {
"zen-secdb": {
"url": "https://secdb.nttzen.cloud/mcp"
}
}
}claude mcp add --transport http zen-secdb https://secdb.nttzen.cloud/mcp{
"servers": {
"zen-secdb": {
"type": "http",
"url": "https://secdb.nttzen.cloud/mcp"
}
}
}11 tools, verified live
epss_timeseriesread-onlyGet the historical EPSS time series for a specific CVE. ## What this tool does Returns the historical EPSS score, percentile, and model version available for a CVE across time, ordered by date. Useful for analyzing how exploitability likelihood has evolved over time. ## When to use this tool Use this tool when the user asks about: - EPSS trend over time - how exploitability probability changed -
linux_auditread-onlyPerform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installe
linux_osread-onlyList supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool. ## What this tool does Returns an array of supported OS/version pairs, each in the form: {"os":"name", "versions":["version or codename"]} This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool. ## When to use this tool Use this tool when:
sightings_searchread-onlySearch real-world vulnerability sightings in SecDB. ## What this tool does Retrieves information about where and how a vulnerability appears in the real world, including: - Exploit-DB, Metasploit modules, PoCs - Scanner plugins (Nessus, OpenVAS/Greenbone) - Vendor advisories - Social/media references (Reddit, Mastodon, Bluesky) - MISP threat-intel sightings ## When to use this tool Use this tool
ssvc_calculatorread-onlyCompute CISA SSVC (Stakeholder-Specific Vulnerability Categorization) for a CVE. ## What this tool does Calculates the SSVC decision (Track, Track*, Attend, Act) using: - exploitation status - technical impact - automatable exploitation - mission prevalence (user-provided) - public well-being impact (user-provided) This reflects CISA's official SSVC prioritization model. ## When to use this too
vulnerability_inforead-onlyGet detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch info
vulnerability_scoreread-onlyGet CVSS and current EPSS score for a specific CVE. ## What this tool does Returns a full risk snapshot for a CVE, including: - CVSS version - CVSS base score - CVSS severity - CVSS vector string - human-readable explanation of the CVSS vector - current EPSS score The field **`cvss_explain`** provides a natural-language interpretation of the CVSS vector (attack conditions, privileges, user inter
vulnerability_searchread-onlyPerform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id
feed_report_catalogread-onlyList available public ZEN SecDB feed reports. ## What this tool does Returns the catalog of available ZEN SecDB public feed reports, including their identifiers, descriptions, and supported input parameters. This tool helps discover which reports can be executed through `feed_report`. ## When to use this tool Use this tool when: - the user asks what public reports are available - you need to di
feed_reportread-onlyRun a public ZEN SecDB feed report. ## What this tool does Executes a predefined report on ZEN SecDB public feed data and returns structured results for analytics, trends, distributions, and top-N summaries. Supported reports can cover public datasets such as: - CVEs - security advisories - EPSS - weaknesses - CPE vendors and products - exploit references - sightings and IOC-related data Use `f
purl_auditread-onlyPerform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies cont
Alternatives in Cloud & Infra
Compare →HAHydrata - ANUGA Flood SimulationA
Run ANUGA flood simulations, track progress, and retrieve results on Hydrata Cloud.
INInfraNodeA
Keyless open data for 84 German cities: 12 lean read-only MCP tools covering 67 data types.
DCDaedalMap CIA World FactbookA
CIA World Factbook country indicators: infrastructure, energy, demographics, economy, 2002-2026.
CCCypress Cloud MCPB
Direct access to Cypress tests results and accessibility reports in your AI workflow.
packagecloud MCP by usefulapiB
Read packagecloud repos, packages, versions and download stats; create repos, promote and delete.
NS1 MCP by usefulapiB
Read NS1 zones, records, monitors, data feeds and usage; create or update one DNS record.