Back to search
100
MCP live MCP 2026-07-28 http ext: skills

cisa-cybersecurity-mcp-server

io.github.cyanheads/cisa-cybersecurity-mcp-server

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

Watch this dependency Share evidence report
Uptime
100.0%
5 direct probes · 30d
Response
1541ms
last probe
Tools
7
callable
Resources
61
readable
Prompts
0
available
Primary URL
https://cisa-cybersecurity.caseyjhand.com/mcp
Score: 100/100
Handshake verified by our own probe.
pass Answers the MCP handshake 50/50
The handshake and the list calls succeeded on the primary URL.
pass Lists tools, resources or prompts 30/30
7 tools, 61 resources, 0 prompts returned.
pass 3 or more catalogue items 10/10
68 items in total; 3 or more earns these points.
pass Describes itself 10/10
100 characters; more than 30 earns these points.

Tools · 7

cisa_list_reference

Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decisi…

cisa_check_cve_status

Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so…

cisa_search_kev

Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry …

cisa_get_ssvc

Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where pr…

cisa_search_ics_advisories

Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, produ…

cisa_get_advisory

Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and …

cisa_get_alerts

List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Cursors continue within the current 30-item rolling window; upstream provides no paginati…

Resources · 61

CVE-2026-19868 — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-19868
CVE-2024-27834 — Apple Multiple Products Improper Authentication Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2024-27834
CVE-2026-119977 — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-119977
CVE-2026-118527 — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-118527
CVE-2026-111357 — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-111357
CVE-2026-97229 — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-97229
CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-76418
CVE-2026-46300 — Linux Kernel Missing Initialization of a Variable Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-46300
CVE-2026-41709 — Broadcom VMWare ESX Insufficient Logging Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-41709
CVE-2026-48356 — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-48356
CVE-2026-111497 — Google Brotli Unchecked Return Value Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-111497
CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-109619
CVE-2026-109618 — PHP Memory Corruption Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-109618
CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-114625
CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-110447
CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-96656
CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-96655
CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-96654
CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-96652
CVE-2026-110936 — Siemens Software Center Uncontrolled Search Path Element Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-110936
CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-106931
CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-102764
CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2025-61624
CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-21589
CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-76519
CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-105134
CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-105133
CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-0322
CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-96951
CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive ci…

cisa://kev/CVE-2026-104935
ICSA-26-211-07 — Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update B)

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-211-07
ICSA-26-307-01 — Subnet Solutions PowerSYSTEM Center

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-307-01
ICSA-26-302-01 — Siemens Mendix SAML Module

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-302-01
ICSA-26-302-02 — Hitachi Energy TRO600 series products

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-302-02
ICSA-26-302-03 — Hitachi Energy CoreTec Product

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-302-03
ICSA-26-258-06 — Siemens Mendix SAML

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-258-06
ICSA-26-125-01 — Hitachi Energy PCM600 (Update A)

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-125-01
ICSA-25-275-02 — Hitachi Energy MSM Product (Update A)

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-25-275-02
ICSA-26-300-01 — EPICS Base

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-300-01
ICSA-26-300-02 — Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-300-02
ICSA-26-267-02 — Eufy Omni C20, Omni X10 Pro (Update A)

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-267-02
ICSA-26-295-01 — Kiloview E3 NDI Encoder

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-01
ICSA-26-295-02 — Siemens Industrial Edge App Publisher

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-02
ICSA-26-295-03 — Siemens Software Center

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-03
ICSA-26-295-04 — Siemens Capital Embedded AR Classic

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-04
ICSA-26-295-05 — Siemens SENTRON 3NA COM Fuse

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-05
ICSA-26-295-06 — Siemens PSS(R)SINCAL

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-06
ICSA-26-295-07 — Siemens SIMATIC IPCs

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-07
ICSA-26-295-08 — Siemens APOGEE, TALON and Desigo PXC/PXM Products

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-08
ICSA-26-295-09 — Siemens Industrial Edge Device Kit

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-09
ICSA-26-295-10 — Siemens SIMATIC S7 Webserver API

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-10
ICSA-26-295-11 — Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-11
ICSA-26-295-12 — Siemens RUGGEDCOM CROSSBOW

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-12
ICSA-26-295-13 — Siemens WinCC

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-13
ICSA-26-295-14 — Siemens SIMATIC S7 PLCs Web Server

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-14
ICSA-26-295-15 — Siemens RUGGEDCOM CROSSBOW Station Access Controller

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-15
ICSA-26-295-16 — Siemens SIMATIC S7-1500 TM MFP

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-16
ICSA-26-295-17 — Siemens Industrial Edge Devices

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-17
ICSA-26-295-18 — Siemens RUGGEDCOM APE1808 Devices

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSA-26-295-18
ICSMA-26-295-01 — InterSystems Corporation InterSystems IRIS for Health

One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return…

cisa://advisory/ICSMA-26-295-01
cisa-cybersecurity-guide

Use cisa_* tools to triage vulnerability lists and trace ICS advisory applicability from CVEs through product definitions, relationships, and scoped remediations. Use for CISA evidence, KEV deadlines,…

skill://cisa-cybersecurity-guide/SKILL.md

Skills · 1

cisa-cybersecurity-guide

Use cisa_* tools to triage vulnerability lists and trace ICS advisory applicability from CVEs through product definitions, relationships, and scoped remediations. Use for CISA evidence, KEV deadlines,…

skill://cisa-cybersecurity-guide/SKILL.md
1 file

How to use

Claude Desktop or claude.ai: add a custom connector (Customize → Connectors; on Team and Enterprise plans an owner adds it under Organization settings → Connectors) with this server URL: https://cisa-cybersecurity.caseyjhand.com/mcp

Cursor or Cline: add to your MCP config:

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "url": "https://cisa-cybersecurity.caseyjhand.com/mcp",
      "transport": "http"
    }
  }
}