CVE Intel is a local vulnerability triage app with an MCP server

A developer who runs a vulnerability scan on a Monday morning and gets back a list of 40 CVEs still has to open 40 browser tabs. CVE Intel does that work in one call. The project, by GitHub user Fazmin, is a free desktop app, CLI and MCP server written in native Rust that checks a CVE ID, a lockfile, or a suspicious IP address, hash or domain against 38 public security sources and returns one risk score, with the evidence behind it. The repository went public on 18 October and has 82 stars three days later, with a last commit the same day it was listed in the candidate feed.

What one lookup gives you

Give CVE Intel a CVE ID and it returns a 0 to 100 risk score, a plain recommendation and the sources it used. The score is built from CVSS severity, FIRST's EPSS probability that the CVE will be exploited in the next 30 days, CISA's KEV catalogue of vulnerabilities known to be exploited, and public exploit code. Anything on KEV is marked CRITICAL by default. The project README states that a Log4Shell lookup, CVE-2021-44228, returns a 100 of 100 score with CISA KEV and ENISA exploited flags, 100 percent EPSS, Metasploit and Exploit-DB evidence and a 30-day EPSS trend.

Four other things it answers in one call

Paste up to 10 CVE IDs from a scanner and the app returns the order to patch them in. Paste a lockfile or SBOM and it lists which packages have known vulnerabilities and which version fixes them. Ask it for a product and version, for example Apache Tomcat 9.0.80, and it lists the known CVEs with actively exploited ones first. A Landscape view shows what changed this week across KEV, ENISA exploited flags, rising EPSS scores, new Metasploit modules, new critical CVEs and the latest CISA advisories.

Local by default, no account

The app runs on the developer's own machine and talks straight from there to the public sources. The project has no CVE Intel server and no account to create. A built-in AI assistant runs locally unless the user picks a cloud provider. The same program also exposes a REST API and an MCP server, so Claude Code, Cursor, VS Code and other coding assistants can run the same queries while they work. The licence is MIT.

The project README is honest about what the tool does not do: CVE Intel helps you decide what to patch and does not scan a network or apply fixes, and the answers are only as current as the public sources it queries. The star count is small and the project is three days old, so the usual caveat applies that an active repository is not a tested dependency.

Source

Fazmin/cve-intel on GitHub.