KitScout

Categories › Security › Pentest & threat intel

vulntel

MCP serverVerified domain · vulntel.comRemote● LiveFree to try

Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports

Install

Remote server: your requests and data go to mcp.vulntel.com. Claude Code: claude mcp add --transport http vulntel https://mcp.vulntel.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

  • enrich_cve — Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with ratio
  • check_technology — Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Dist
  • hunt_plan — Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV
  • observe — Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the back
  • search_vulns — Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "
  • find_attack_approaches — Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mecha
  • find_continuations — When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTI
  • assist_submission — Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get
  • program_outcome_prior — At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide
  • new_in_scope — Find FRESH attack surface: bounty-eligible assets that entered a public bug-bounty program's scope in the last `days` (HackerOne, Bugcrowd,
  • verify_cve_claim — Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the
  • corpus_stats — Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps).
  • search_public_code — Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerab

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools