# 政府网络安全漏洞情报 来自 4 个权威来源的实时漏洞情报——无需 API 密钥。 ## 设置 连接远程 MCP 服务器： ``bash mcporter add gov-cyber --url https://cybersecurity-vuln-mcp.apify.actor/mcp --transport streamable-http ` 或直接添加到 OpenClaw MCP 配置（~/.openclaw/mcp.json）： `json { "servers": { "gov-cyber": { "url": "https://cybersecurity-vuln-mcp.apify.actor/mcp", "transport": "streamable-http" } } } ` ## 可用工具 ### vuln_lookup_cve 通过 CVE ID 查询，并一次性获取 4 个来源的丰富情报——NVD 详情（CVSS 分数、描述、参考）、CISA KEV 主动利用状态、EPSS 利用概率、MITRE ATT&CK 技术。 ` Look up CVE-2021-44228 ` 示例输出：CRITICAL 10.0, EPSS 94.4%, KEV=YES, ATT&CK: T1190/T1203/T1595.002 ### vuln_search 通过关键字、严重程度和日期范围搜索 NIST 国家漏洞数据库。 ` Search NVD for "apache log4j" critical vulnerabilities ` 参数：keyword、severity（LOW/MEDIUM/HIGH/CRITICAL）、pubStartDate、pubEndDate、limit ### vuln_kev_latest 获取 CISA 已知被利用漏洞目录中最近新增的条目——已在野外确认被主动利用。 ` Show KEV entries added in the last 7 days ` 参数：days（1-365，默认 7）、limit ### vuln_kev_due_soon 获取 CISA KEV 中即将到达修复截止日期的漏洞。联邦机构必须在截止日期前完成修补。 ` Show KEV vulnerabilities due within 14 days ` 参数：days（1-90，默认 14）、limit ### vuln_epss_top 获取 EPSS 利用概率得分最高的 CVE。0.9 分表示未来 30 天内有 90% 被利用的可能性。 ` Show CVEs with EPSS score above 0.9 ` 参数：threshold（0-1，默认 0.5）、limit ### vuln_trending 获取最近发布的高危和严重级别 CVE。及时掌握新兴威胁。 ` Show trending critical CVEs from the last 3 days ` 参数：days（1-30，默认 3）、severity、limit ### vuln_by_vendor 针对特定厂商/产品搜索 CVE，并交叉引用 KEV 以识别被主动利用的漏洞。 ` Show Microsoft Windows vulnerabilities ` 参数：vendor（必填）、product（可选）、limit` ## 数据来源 - NIST NVD 2.0 —— 国家漏洞数据库（CVE 详情、CVSS 分数） - CISA KEV —— 已知被利用漏洞目录 - FIRST.org EPSS —— 利用预测评分系统 - MITRE ATT&CK —— 敌对技术与战术（172 个 CVE 映射到 42 种技术） ## 使用场景 - 漏洞分类与优先级排序 - 合规跟踪（CISA KEV 截止日期） - 供应商风险评估 - 威胁情报简报 - 补丁管理决策 所有数据来自免费的美国政府 API。零成本。无需 API 密钥。
Real-time vulnerability intelligence from 4 authoritative sources — no API keys required.
Setup
Connect to the remote MCP server:
mcporter add gov-cyber --url https://cybersecurity-vuln-mcp.apify.actor/mcp --transport streamable-http
Or add directly to your OpenClaw MCP config (~/.openclaw/mcp.json):
{
"servers": {
"gov-cyber": {
"url": "https://cybersecurity-vuln-mcp.apify.actor/mcp",
"transport": "streamable-http"
}
}
}
Available Tools
vuln_lookup_cve
Look up a CVE by ID and get enriched intelligence from all 4 sources in a single call — NVD details (CVSS score, description, references), CISA KEV active exploitation status, EPSS exploitation probability, and MITRE ATT&CK techniques.
Look up CVE-2021-44228
Example output: CRITICAL 10.0, EPSS 94.4%, KEV=YES, ATT&CK: T1190/T1203/T1595.002
vuln_search
Search the NIST National Vulnerability Database by keyword, severity, and date range.
Search NVD for "apache log4j" critical vulnerabilities
Parameters: keyword, severity (LOW/MEDIUM/HIGH/CRITICAL), pubStartDate, pubEndDate, limit
vuln_kev_latest
Get recently added entries from the CISA Known Exploited Vulnerabilities catalog — confirmed actively exploited in the wild.
Show KEV entries added in the last 7 days
Parameters: days (1-365, default 7), limit
vuln_kev_due_soon
Get CISA KEV vulnerabilities with upcoming remediation deadlines. Federal agencies must patch by the due date.
Show KEV vulnerabilities due within 14 days
Parameters: days (1-90, default 14), limit
vuln_epss_top
Get CVEs with the highest EPSS exploitation probability scores. A score of 0.9 = 90% chance of exploitation in the next 30 days.
Show CVEs with EPSS score above 0.9
Parameters: threshold (0-1, default 0.5), limit
vuln_trending
Get recently published critical and high severity CVEs. Stay on top of emerging threats.
Show trending critical CVEs from the last 3 days
Parameters: days (1-30, default 3), severity, limit
vuln_by_vendor
Search CVEs for a specific vendor/product with KEV cross-referencing for actively exploited vulns.
Show Microsoft Windows vulnerabilities
Parameters: vendor (required), product (optional), limit
Data Sources
- NIST NVD 2.0 — National Vulnerability Database (CVE details, CVSS scores)
- CISA KEV — Known Exploited Vulnerabilities catalog
- FIRST.org EPSS — Exploitation Prediction Scoring System
- MITRE ATT&CK — Adversary techniques and tactics (172 CVEs mapped to 42 techniques)
Use Cases
- Vulnerability triage and prioritization
- Compliance tracking (CISA KEV deadlines)
- Vendor risk assessments
- Threat intelligence briefings
- Patch management decisions
All data from free US government APIs. Zero cost. No API keys required.
by