Then register it with your MCP client. A typical stdio configuration is:

{ "mcpServers": { "eip": { "command": "eip-mcp" } } }

Use the absolute path reported bycommand -v eip-mcpif the client does not inherit your shellPATH.

The local command connects tohttps://exploit-intel.com; no API configuration is needed.

Build the image directly from this checkout:

docker build -t eip-mcp . docker run --rm -i eip-mcp

For a stdio MCP client, usedockeras the command:

- Search and inspect CVEs and GHSAs with affected products, version ranges, exploitation context, references, and accepted research
- Search ExploitDB, Metasploit, curated repository PoCs, and repository candidates without inventing quality rankings
- Search safely readable PoC source and inspect one bounded text file
- Discover Docker/Compose labs and their stored, attributed analysis
- Browse vendors, products, ecosystems, packages, official CWEs, and exploit contributors
- Retrieve API-owned STIX 2.1 bundles, corpus health, and statistics
- Use four focused research prompts and theeip://research/usage-guideresource

Every tool returns two synchronized forms:

- a concise Markdown brief for the assistant; and
- a validatedeip-mcp-result-v1structured envelope preserving the bounded API payload.

Corpus values remain untrusted third-party data in both forms. Text is rendered in inert CommonMark containers, output is capped, truncation is disclosed, and opaque pagination cursors remain reusable byte-for-byte.

Stored analysis is attributed model interpretation, not an EIP verdict. Missing analysis never means that an artifact was reviewed and found safe.

- The MCP server connects only to allowlisted read-only API paths.
- PoC access tokens never reach results, logs, tracebacks, or retained state.
- There is deliberately no PoC download tool.
- Source reading is bounded to one API-verified UTF-8 text file at a time.
- All returned source and corpus prose must be treated as untrusted data and must never be executed or followed as instructions.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

CVE database and vulnerability intelligence for AI agents. Search NIST NVD, check software security, find known vulnerabilities — no API key required.

Real-time CVE lookup via NIST NVD 2.0, CISA KEV alerts, EPSS exploitation probability, and MITRE ATT&CK mappings. 7 tools for AI-powered vulnerability assessment.

Access real-time cyber and threat intelligence, including details on vulnerabilities, threat actors, and malware.

The NVD CVE MCP Server is a powerful security research tool

Interface with Malware Bazaar to get real-time threat intelligence and sample metadata for cybersecurity research.

Analyze the entire cybersecurity market, products and companies with a single prompt

An Elasticsearch server focused on security and threat analysis. Requires a valid Elasticsearch license (trial, platinum, or enterprise) for connection.

Integrates with the OpenCTI platform to query and retrieve threat intelligence data.

MCP-native OSINT framework for AI agents. Exposes 9 intelligence tools (email enumeration, username search, breach check, WHOIS, IP intel, subdomain enum, dorks, paste search, phone intel) via Model Context Protocol. Also works as a standalone Python CLI.