Threatist MCP Server

by threatist Your server? Claim it

answering

Threatist is answering right now. Last checked 6 min ago. It exposes 5 tools.

Vulnerability records: CVE, GHSA, CISA KEV, EPSS and vendor fixes in one place. No key needed.

Uptime history 13 hours of history

13 hours agonow

100.0%

Uptime 24h

47 of 47 checks

Tools

read from the server

241 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check Threatist every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 6 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add threatist --transport http https://threatist.io/mcp

Settings → Connectors → Add custom connector, then paste this address

https://threatist.io/mcp

~/.codex/config.toml

[mcp_servers.threatist]
url = "https://threatist.io/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "threatist": {
      "url": "https://threatist.io/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "threatist": {
      "type": "http",
      "url": "https://threatist.io/mcp"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

advisory

get_advisory

A Red Hat RHSA or Microsoft KB or ADV with its CVEs and records.

exploited

list_exploited

Recent additions to CISA's Known Exploited Vulnerabilities catalogue. Newest first, each with its Threatist record.

vendor

get_vendor

A vendor's records, highest priority first. Takes the same filters as search_vulnerabilities.

vulnerabilities

search_vulnerabilities

Records matching a text and filters, a page at a time. Pass next as cursor for the next page.

vulnerability

get_vulnerability

A record for a TI id or an alias such as a CVE or GHSA id. Merged ids give the surviving record. By default the record is shortened: no CPE matches, at most 20 references (exploits and patches first) and the 10 newest advisories; trimmed says what was cut.

Endpoints

URL	Transport	State	Latency	Checked
https://threatist.io/mcp	streamable-http	answering	216 ms	6 min ago

Alternatives to Threatist

same job, measured the same way

Nvd Cve MCP

by mrfentmen

Search CVE vulnerability records from the NIST NVD database. No key required.

83 installs/wk local only

Purify Security Feeds

by eason4kim-rocket

Query CISA KEV / EPSS vulnerability feeds with full per-record provenance and auditable versions

local only

Vulnerability Exposure

by mrfrazer25

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

742 installs/wk local only

NotCVE — CVE & Vulnerability Intelligence

by notcve

CVE & vulnerability search: 365k+ CVEs/NotCVEs, CVSS, EPSS, CISA KEV, exploits, patches, versions.

answering

Vuln Triage MCP

by kimmawla

Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.

137 installs/wk local only

AcidPeak

by acidpeak

Read-only vulnerability intelligence: CVEs, exploitation evidence, fixes and product matches.

10 tools answering

overflo.ws

by overflo

Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.

7 tools answering

FIRST EPSS CVE Exploit Score & OSV Vulnerability Audit

by ceadigital

Real-time FIRST.org EPSS 30-day CVE exploit probability scoring and OSV package security audit.

28 tools answering

Threatist — questions

Answers built from our own checks of this server.

What can Threatist do?

It exposes 5 tools, read directly from the server on our last check. Among them: get_advisory, get_vendor, get_vulnerability, list_exploited, search_vulnerabilities. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Threatist working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 47 of 47 checks got a reply (100.0%), average response time 241 ms. The bar chart above shows every period we have measured.

How do I connect Threatist?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Threatist need an API key?

No. Threatist completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Threatist?

It answers our handshake in 241 ms on average, which is faster than 56% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.