Categories › Security › Code & dependency scanning
Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
Remote server: your requests and data go to cve.openkrill.app. Claude Code: claude mcp add --transport http cve-risk-check https://cve.openkrill.app/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
check_cve — Use this when the user asks how serious a CVE is, such as "how bad is CVE-2021-44228?", or about an advisory id that triage_dependencies namcheck_cves — Rank several CVEs. Use this when the user has a list of CVE ids and wants to know which to deal with first, such as "which of these CVEs sholist_recent_kev — Use this when the user asks what CISA recently added to its Known Exploited Vulnerabilities list, such as "what exploited CVEs were added thtriage_dependencies — Use this when the user wants to know which vulnerable dependencies to fix first, such as "which dependencies in this package-lock.json shoulsubmit_feedback — Send feedback, a bug report or a tool request to the maintainers of the tools on this server: a missing tool, missing or stale data, or a toget_feedback_reply — Read the maintainers' reply to feedback you sent with submit_feedback, given its ticket id. Returns status pending until a reply is ready, tNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.