CVErdict runs on your own machine — the client starts it, so there is no endpoint to ping. 741 installs a week from npm. Last commit 5 Nov 2026.
Read-only CVE triage: verdicts from CISA KEV, EPSS and exploit feeds, each reason linked.
What the code does
We read the source, 2 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const stem = path.join(this.dir, req.key);
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add cverdict -- npx -y cverdict-mcp{
"mcpServers": {
"cverdict": {
"command": "npx",
"args": [
"-y",
"cverdict-mcp"
]
}
}
}[mcp_servers.cverdict]
command = "npx"
args = ["-y", "cverdict-mcp"]{
"mcpServers": {
"cverdict": {
"command": "npx",
"args": [
"-y",
"cverdict-mcp"
]
}
}
}{
"servers": {
"cverdict": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"cverdict-mcp"
]
}
}
}Optional settings from the registry entry, left out of the block above:
CVERDICT_DATA_BASE (Comma-separated data base URLs ending in /v1/, tried in order. For a fork or a mirror).
Alternatives to CVErdict
same job, measured the same wayIs a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.
x402 CVE triage MCP: EPSS + CISA KEV -> exploit priority, $0.01 per query.
Daily CVE priorities ranked by real exploitation (KEV+EPSS) for AI agents; free teaser, paid full
CISA KEV status and EPSS scores for CVE IDs, ranked P1/P2/P3 for patching, via Apify.
Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
Read-only access to your Tomelet notes, highlights and bookmarks, each linked to its page.
LinkedIn outreach from Claude with a human veto: review, approve and send drafts, triage replies.
Vulnerability records: CVE, GHSA, CISA KEV, EPSS and vendor fixes in one place. No key needed.
CVErdict — questions
Answers built from our own checks of this server.