US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit MCP Server

by ceadigital Your server? Claim it

answering

US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit is answering right now. Last checked 10 min ago. It exposes 28 tools.

US CISA Known Exploited Vulnerabilities (KEV) catalog & active ransomware campaign check.

Uptime history 46 hours of history

46 hours agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

222 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 1

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 6 November 2026. No other catalogue keeps this.

6 Nov a tool appeared agent_url_to_clean_markdown

Nothing serious here today

Today is the operative word: we check US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add cisa-kev-exploited-vulns --transport http https://ceadigital.io/mcp/cisa-kev

Settings → Connectors → Add custom connector, then paste this address

https://ceadigital.io/mcp/cisa-kev

~/.codex/config.toml

[mcp_servers.cisa-kev-exploited-vulns]
url = "https://ceadigital.io/mcp/cisa-kev"

.cursor/mcp.json

{
  "mcpServers": {
    "cisa-kev-exploited-vulns": {
      "url": "https://ceadigital.io/mcp/cisa-kev"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "cisa-kev-exploited-vulns": {
      "type": "http",
      "url": "https://ceadigital.io/mcp/cisa-kev"
    }
  }
}

Available tools 28

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

agent

agent_base_tx_simulate

High-velocity Agent Operational Primitive ($0.005 USDC on Base): Pre-execution Base L2 (eip155:8453) calldata simulator & wallet drain guard via eth_call + eth_estimateGas + unlimited ERC-20 approve detection.

agent_clean_web_grounding

High-velocity Agent Operational Primitive ($0.008 USDC on Base): Fast, token-optimized real-time web grounding & clean Markdown synthesis stripped of HTML bloat, ads, and scripts for LLM context windows.

agent_compliance_notary_attest

Tamper-evident SHA-256 hash-chained Agent Decision & Compliance Notary for EU AI Act, NIST AI RMF, and SOC2 autonomous agent audit trails.

agent_token_intel_and_honeypot

High-velocity Agent Operational Primitive ($0.005 USDC on Base): Real-time DEX pool liquidity, 24h volume, buy/sell execution symmetry, Base bytecode check, and deterministic 0-100 Honeypot & Anti-Rug Safety Score.

agent_url_to_clean_markdown

High-velocity Agent Operational Primitive ($0.005 USDC on Base): Live URL-to-Clean-Markdown extractor competing with Firecrawl/Jina. Fetches any public URL via SSRF-safe HTTP + LegalTDMGuard and returns clean, prompt-injection-scrubbed Markdown.

cfpb

cfpb_complaints

Query US Consumer Financial Protection Bureau (CFPB) complaint database (17 U.S.C. § 105 public domain).

cisa

cisa_kev_exploited_vulns

Query US CISA Known Exploited Vulnerabilities (KEV) Catalog for active in-the-wild exploitation, mandatory federal patch due dates, and ransomware usage.

corporate

corporate_kyb_and_risk_dossier

5-Source Parallel Composite Dossier: Joins GLEIF LEI + SEC EDGAR + CFPB Complaints + USASpending Federal Awards + FDIC in <400ms with a 0-100 Counterparty Verification Score.

crtsh

crtsh_cert_recon

Query Sectigo Certificate Transparency logs (crt.sh) for issued SSL/TLS certificates and subdomains.

cyber

cyber_supply_chain_security_dossier

5-Source Parallel Security Dossier: Joins crt.sh SSL Certs + Google deps.dev OpenSSF Scorecard + FIRST.org EPSS + CISA KEV + OSV.dev CVEs in <400ms with a 0-100 Security Posture Score.

depsdev

depsdev_openssf_scorecard

Query Google Open Source Insights (deps.dev) and Linux Foundation OpenSSF Security Scorecard (0-10) for any GitHub repository or package (#1 in MCP Registry).

dexscreener

dexscreener_token_audit

Real-time DEX liquidity, price, pair volume, and market cap analytics via DexScreener.

epss

epss_exploit_score

Query FIRST.org Exploit Prediction Scoring System (EPSS) for 30-day real-world exploit probability.

fdic

fdic_bank_health

Factual public supervisory bank health and branch metrics compiled from FDIC under 12 CFR Part 328.

gcp

gcp_catalog_search

Sub-millisecond FTS5 search across 17,671 Google Cloud, Vertex AI, and A2A service records.

github

github_repo_pulse

Extract repository activity pulse (stars, forks, open issues, license, last push) with ETag caching.

gleif

gleif_lei_kyb

Query Global Legal Entity Identifier Foundation (GLEIF) registry for corporate KYB and LEI records.

npi

npi_medical_registry

CMS NPPES NPI Registry lookup for healthcare organizations and facilities (NPI-2 only, HIPAA safe harbor).

nyfed

nyfed_sofr_reference_rates

Query Federal Reserve Bank of New York official Secured Overnight Financing Rate (SOFR) benchmark rates, percentiles, and daily repo volume (#1 in MCP Registry).

openalex

openalex_citation_graph

Academic citation graph metadata and scholarly network metrics from OpenAlex (CC0).

package

package_health_pulse

Parallel health pulse inspection across NPM and PyPI ecosystems.

provision

provision_free_developer_key

FREE Self-Serve API Key Generator: Instantly mints a 50-call free starter `cea_live_` Bearer token with copy-paste snippets for Claude Desktop, Cursor, Windsurf, ElizaOS, and Coinbase AgentKit.

sec

sec_edgar_cik_lookup

SEC EDGAR company submission facts, quarterly filings, and CIK lookup under Lowe v. SEC Publisher's Exclusion.

security

security_cve_audit

Audit package vulnerabilities and CVE advisories via OSV.dev database.

submit

submit_feedback_or_rate_quote

Free interactive MCP feedback, feature requests, and custom rate quote negotiation (alias: submit_mcp_feedback_or_request).

usaspending

usaspending_awards

Query USASpending.gov Federal Awards and Contractor Intelligence (17 U.S.C. § 105 public domain).

usgs

usgs_seismic_hazard

Seismic activity and earthquake risk profiles from USGS GeoJSON services.

vault

vault_knowledge_search

FTS5 search across 36,628 video transcript chunks and 106,308 knowledge graph triples in vault.db.

Endpoints

URL	Transport	State	Latency	Checked
https://ceadigital.io/mcp/cisa-kev	streamable-http	answering	215 ms	10 min ago

Alternatives to US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit

same job, measured the same way

CISA Known Exploited Vulnerabilities (kevwatch)

by a2awire

CISA KEV catalog: active-exploit alerts, hourly. Register in-session — free testnet funds.

17 tools answering

Exploitwatch

by vercel-exploitwatch-kappa

Check dependencies against CISA's real Known Exploited Vulnerabilities feed.

1 tools answering

Cisa Kev MCP

by mrfentmen

Use this MCP server to CISA Known Exploited Vulnerabilities catalog search. Tools include search...

97 installs/wk local only

CISA KEV Ransomware CVE, SSL CT Logs & Domain Recon

by jesleytassili-glitch

Audit active CISA KEV ransomware CVEs, SSL/TLS CT log subdomains, SPF/DMARC security & ICANN RDAP.

answering

Vulnerability Exposure

by mrfrazer25

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

1 046 installs/wk local only

Dependency check

by ladanyin

Check a package version for known vulnerabilities and Packagist release facts.

2 tools answering

Depcheck

by kaneky

Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.

1 tools answering

KEVWire

by kevwire

Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.

5 tools answering

US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit — questions

Answers built from our own checks of this server.

What can US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit do?

It exposes 28 tools, read directly from the server on our last check. Among them: agent_base_tx_simulate, agent_clean_web_grounding, agent_compliance_notary_attest, agent_token_intel_and_honeypot, agent_url_to_clean_markdown, cfpb_complaints and 22 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 222 ms. The bar chart above shows every period we have measured.

How do I connect US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit need an API key?

No. US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 28 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit?

It answers our handshake in 222 ms on average, which is faster than 65% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.