11 tools that work with CISA: 10 MCP servers, 1 Agent Skills and 0 Claude Code plugins. 6 of the remote servers answered our live check, 1 worked without an API key, and 7 come from an official or verified publisher. Ranked by GitHub stars plus official, live and free-to-try signals.
Most common uses: Code & dependency scanning (10), Multi-agent, orchestration & workflows (1).
| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| building-ransomware-playbook-with-cisa-framework Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering prepar SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| app.vercel.exploitwatch-kappa/exploitwatch Check dependencies against CISA's real Known Exploited Vulnerabilities feed. MCP serverVerified domain · exploitwatch-kappa.vercel.appRemote● LiveFree to try | — | — | ||
| CISA Cybersecurity & ICS Advisories — buy per-query in-session (cisaalerts) CISA advisories & ICS alerts: new CVEs, remediation. Be born in one call — free testnet funds. MCP serverVerified domain · a2awire.comRemote● LiveAPI key needed | — | — | ||
| CISA Known Exploited Vulnerabilities (kevwatch) CISA KEV catalog: active-exploit alerts, hourly. Be born in one call — free testnet funds. MCP serverVerified domain · a2awire.comRemote● LiveAPI key needed | — | — | ||
| Kevscope CVE patch-priority API + MCP: CISA KEV, EPSS, CVSS, SSVC. Keys $19/mo; 200 free calls/day. MCP serverVerified domain · cybermax.cybermax-tools.workers.devRemote● Live | — | — | ||
| Kevscope CVE Check Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key. MCP serverVerified domain · cybermax.cybermax-tools.workers.devRemote● Live | — | — | ||
| US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit US CISA Known Exploited Vulnerabilities (KEV) catalog & active ransomware campaign check. MCP serverVerified domain · ceadigital.ioRemote● LivePaid calls | — | — | ||
| com.edgethirteen.www/exploitwatch Check a dependency list against CISA's live Known Exploited Vulnerabilities catalog. MCP serverVerified domain · www.edgethirteen.comRemoteDown | — | — | ||
| io.github.cyanheads/cisa-cybersecurity-mcp-server CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless. MCP serverGitHub-verified authorLocal · npm | 1 | Apache-2.0 | ||
| io.github.jmshinhwa/ssdf-attestation-workflow-audit 14 rules, four CISA attestation sections, one workflow file MCP serverGitHub-verified authorLocal · npm | 1 | — | ||
| Purify Security Feeds Query CISA KEV / EPSS vulnerability feeds with full per-record provenance and auditable versions MCP serverGitHub-verified authorLocal · Docker | 0 | MIT |