io.github.cyanheads/cisa-cybersecurity-mcp-server

Est-ce que io.github.cyanheads/cisa-cybersecurity-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/cisa-cybersecurity-mcp-server » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 7 outils

• cisa_check_cve_status≈ 2284 tokens

  Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.

  Paramètres, retour & exemple (2)

  Paramètres

  • cveIds · array · requis
    CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail "summary".
  • detail · string · optionnel · full | summary
    full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both.

  Exemple d'appel

  {"name": "cisa_check_cve_status", "arguments": {"cveIds": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"asOf": "texte", "error": {}, "notice": "texte", "catalog": {}, "results": [], "foundCount": 1, "summaryNote": "texte", "notFoundCount": 1}}

• cisa_get_advisory≈ 4401 tokens

  Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, or remediations. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.

  Paramètres, retour & exemple (4)

  Paramètres

  • cves · array · optionnel
    Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include "vulnerabilities".
  • sections · array · optionnel
    Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget.
  • advisoryId · string · requis
    Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized.
  • productIds · array · optionnel
    Narrow products to these IDs from vulnerability status, score, or remediation references. Alone selects products; combined with cves selects both sections. Explicit sections must include products.

  Exemple d'appel

  {"name": "cisa_get_advisory", "arguments": {"advisoryId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"kind": "full", "error": {}, "found": true, "summary": {}, "advisory": {}, "guidance": "texte", "products": {}, "sections": [], "references": [], "outlineNotice": "texte", "acknowledgments": [], "indexCheckpoint": "texte"}}

• cisa_get_alerts≈ 1549 tokens

  List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.

  Paramètres, retour & exemple (3)

  Paramètres

  • feed · string · optionnel · advisories | alerts | ics
    Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks).
  • limit · integer · optionnel
    Maximum items to return. The 30 ceiling is the upstream window, not a server choice.
  • since · string · optionnel
    Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it.

  Exemple d'appel

  {"name": "cisa_get_alerts", "arguments": {"feed": "advisories", "limit": 1, "since": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cap": 1, "feed": "advisories", "error": {}, "items": [], "shown": 1, "stale": true, "notice": "texte", "window": {}, "feedUrl": "texte", "feedTitle": "texte", "fetchedAt": "texte", "truncated": true}}

• cisa_get_ssvc≈ 2338 tokens

  Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.

  Paramètres, retour & exemple (2)

  Paramètres

  • cveIds · array · requis
    CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check.
  • assetExposure · string · optionnel · publicly_exposed | not_publicly_exposed | unknown
    Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. "unknown" returns both arms so the spread is visible without guessing.

  Exemple d'appel

  {"name": "cisa_get_ssvc", "arguments": {"cveIds": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"echo": {}, "error": {}, "notice": "texte", "results": [], "foundCount": 1, "notFoundCount": 1}}

• cisa_list_reference≈ 2730 tokens

  Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.

  Paramètres, retour & exemple (1)

  Paramètres

  • topic · string · requis · directives | kev_fields | ssvc_values | sectors | advisory_id_formats | severity_bands | sources
    Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds).

  Exemple d'appel

  {"name": "cisa_list_reference", "arguments": {"topic": "directives"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "title": "texte", "topic": "directives", "entries": [], "sources": {}, "summary": "texte", "supersedes": [], "definitions": [], "timelineTable": []}}

• cisa_search_ics_advisories≈ 3487 tokens

  Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.

  Paramètres, retour & exemple (20)

  Paramètres

  • q · string · optionnel
    Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number.
  • cve · string · optionnel
    Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized.
  • cwe · string · optionnel
    Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children.
  • inKev · boolean · optionnel
    true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result.
  • limit · integer · optionnel
    Maximum advisories per page.
  • order · string · optionnel · asc | desc
    Sort direction. Under relevance, desc means most relevant first.
  • cursor · string · optionnel
    Opaque pagination cursor from a previous call. Omit for the first page.
  • sector · string · optionnel · Chemical | Commercial Facilities | Communications | Critical Manufacturing | Dams | Defense Industrial Base | Emergency Services | Energy
    Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors.
  • series · string · optionnel · ICSA | ICSMA
    Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus.
  • sortBy · string · optionnel · relevance | published | revised | maxCvss
    Field to sort by. relevance requires q and ranks by FTS5 bm25.
  • vendor · string · optionnel
    Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact.
  • cvssMax · number · optionnel
    Maximum value of the advisory's maximum CVSS base score, inclusive.
  • cvssMin · number · optionnel
    Minimum value of the advisory's maximum CVSS base score, inclusive.
  • product · string · optionnel
    Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters.
  • severity · string · optionnel · NONE | LOW | MEDIUM | HIGH | CRITICAL
    Severity band of the advisory's maximum CVSS score.
  • publisher · string · optionnel · coordinator | other
    coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus.
  • revisedTo · string · optionnel
    Latest current release date, inclusive, YYYY-MM-DD.
  • publishedTo · string · optionnel
    Latest initial release date, inclusive, YYYY-MM-DD.
  • revisedFrom · string · optionnel
    Earliest current release date, inclusive, YYYY-MM-DD.
  • publishedFrom · string · optionnel
    Earliest initial release date, inclusive, YYYY-MM-DD.

  Exemple d'appel

  {"name": "cisa_search_ics_advisories", "arguments": {"q": "texte", "cve": "texte", "cwe": "texte", "inKev": true, "limit": 1, "order": "asc"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cap": 1, "error": {}, "shown": 1, "cursor": "texte", "mirror": {}, "notice": "texte", "hasMore": true, "results": [], "truncated": true, "totalCount": 1, "cvssCoverage": "texte", "appliedFilters": {}}}

• cisa_search_kev≈ 3051 tokens

  Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.

  Paramètres, retour & exemple (17)

  Paramètres

  • cwe · string · optionnel
    Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match.
  • limit · integer · optionnel
    Maximum entries per page.
  • order · string · optionnel · asc | desc
    Sort direction.
  • cursor · string · optionnel
    Opaque pagination cursor from a previous call. Omit for the first page.
  • sortBy · string · optionnel · dueDate | dateAdded
    Field to sort by.
  • overdue · boolean · optionnel
    True selects entries whose due date is strictly before the echoed asOf date.
  • product · string · optionnel
    Case-insensitive substring of CISA's own product label.
  • dueAfter · string · optionnel
    Earliest due date, inclusive, YYYY-MM-DD.
  • directive · string · optionnel · BOD 26-04 | BOD 22-01 | none
    Which directive the entry cites. "none" selects the entries citing neither.
  • dueBefore · string · optionnel
    Latest due date, inclusive, YYYY-MM-DD.
  • ransomware · boolean · optionnel
    True selects entries CISA has linked to ransomware campaigns.
  • cveIdPrefix · string · optionnel
    Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized.
  • dateAddedTo · string · optionnel
    Latest date added, inclusive, YYYY-MM-DD.
  • nameContains · string · optionnel
    Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback.
  • dateAddedFrom · string · optionnel
    Earliest date added, inclusive, YYYY-MM-DD.
  • vendorProject · string · optionnel
    Case-insensitive substring of CISA's own vendor label.
  • forensicTriage · boolean · optionnel
    True selects the BOD 26-04 three-day forensic-triage tier.

  Exemple d'appel

  {"name": "cisa_search_kev", "arguments": {"cwe": "texte", "limit": 1, "order": "asc", "cursor": "texte", "sortBy": "dueDate", "overdue": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cap": 1, "asOf": "texte", "error": {}, "shown": 1, "cursor": "texte", "notice": "texte", "catalog": {}, "hasMore": true, "results": [], "truncated": true, "totalCount": 1, "appliedFilters": {}}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://cisa-cybersecurity.caseyjhand.com/mcp