MCP server · CyberMax

Kevscope CVE Check MCP server

Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.

Free: Free; fair-use rate limit

Connect

Streamable HTTP endpoint: https://gpt-kevscope.cybermaxtools.com/mcp (the original https://chatgpt-apps.cybermax-tools.workers.dev/kevscope/mcp keeps working). Add it to Claude Desktop, Cursor, Windsurf or VS Code:

{
  "mcpServers": {
    "kevscope-chatgpt": {
      "type": "http",
      "url": "https://gpt-kevscope.cybermaxtools.com/mcp"
    }
  }
}

No key needed for the free tier. For more calls, add your paid key as the x-api-key header. Server card (JSON): https://gpt-kevscope.cybermaxtools.com/.well-known/mcp.json · Product page: Kevscope CVE Check

Tools

Tool	What it does	Effect	Inputs (* required)
`check_cves`	Use this when the user asks whether a CVE is exploited, how severe it is, or which vulnerabilities to patch first ("is CVE-… exploited", "prioritise these CVEs", "KEV status", "EPSS score"). Pass up to 20 CVE IDs (or text containing them). Returns CISA KEV status, EPSS, CVSS, SSVC and a sorted verdict with reasons.	read-only, calls public sources on the internet, never destructive	`cves`*
`recent_kev`	Use this when the user asks which vulnerabilities CISA recently added to the Known Exploited Vulnerabilities catalog, optionally for one vendor or product ("new KEV entries this week", "exploited Microsoft vulnerabilities this month", "ransomware-linked CVEs").	read-only, calls public sources on the internet, never destructive	`days`, `vendor`, `ransomwareOnly`, `limit`

Security and data handling

Your tool arguments are used only to answer that call. They are not saved to a database, shared, sold or used for training.
To make repeat lookups fast, some servers keep the public answer to a lookup in Cloudflare's edge cache for up to 7 days (most for 1 hour or less). It holds the public result, not who asked.
Free tier: a per-day counter keyed by a SHA-256 hash of your IP address and the date (in a Cloudflare Durable Object). The raw IP is not stored.
Paid key: the key is checked with the payment provider (Stripe; Polar for older keys) and the result is cached for 10 minutes; usage is counted per key per month.
No accounts, cookies or tracking on the MCP endpoint. Errors may appear in Cloudflare's short-lived Worker logs.
Every tool is read-only: it looks up public data and returns it. No tool writes, deletes, sends messages or spends money.

Registry and source

Official MCP Registry: dev.workers.cybermax-tools.cybermax/kevscope-chatgpt, version 1.0.1.
Public manifest, tool schemas and security notes (MIT): gitlab.com/CyberMax.tools/agent-tools/mcp/kevscope-chatgpt. The hosted service code is not public.
Report a vulnerability: security policy.

← All CyberMax MCP servers

Free: the Free API Starter Kit

Copy-paste calls for 4 APIs with free daily tiers (CVE priority, VIN recalls, US duty rates, email checks), then 5 short emails on KEV/EPSS, MCP and free data.