Next free-source huntWe check for new free data every weekday.
Cyber ThreatMCP serverFirst audited Nov 13, 2026

KEVWire

Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 1.3 s.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
No, read-onlyAll 5 tools say they only read.
Endpointhttps://kevwire.com/mcp

Website Streamable HTTP · protocol 2025-06-18 · server version 6.0.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 5 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Note: Protocol version 2025-06-18.

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (5)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • search_vulnerabilitiesSearch the KEVWire corpus (CISA KEV, NVD high/critical CVEs, GitHub advisories, national CERTs, security reporting, editorial records) by words, technology, kind or exploitation. Use it to answer "is…Read-only
  • get_recordFetch one record by CVE ID, GHSA ID, or KEVWire record ID, with every source, measurement date, CISA deadline and a permalink. Any published CVE resolves, even outside the tracked set. Returns isErro…Read-only
  • list_recent_exploitedVulnerabilities with documented exploitation (CISA KEV or explicit reporting) published within the last N days, most urgent first. Use it for briefings such as "what was exploited this week"; to narr…Read-only
  • list_technologiesTechnology labels (vendors and products) usable in search_vulnerabilities' technologies filter, with how many records each covers, most covered first. Use it to find the exact label before filtering.…Read-only
  • list_sourcesEvery source KEVWire ingests, with scope, limitations, retrieval status, last success and record counts. Use it to describe coverage honestly or to explain why something may be missing.Read-only

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 2001282 ms
initializedHTTP 202722 ms
tools/listHTTP 2001420 ms
unknown-methodHTTP 200860 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.