io.github.cyanheads/cisa-cybersecurity-mcp-server

CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.

What does this entry provide?

io.github.cyanheads/cisa-cybersecurity-mcp-server is an MCP server entry in ChatHome Skills, sourced from Official MCP Registry and scored 78/100. As a Model Context Protocol server, it exposes tools that MCP-compatible LLM clients such as Claude, Cursor, and Copilot can call directly, extending an agent's reach beyond its built-in capabilities. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding io.github.cyanheads/cisa-cybersecurity-mcp-server to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.

Snapshot facts

Source: Official MCP Registry
Quality: 78/100
Install method: streamable-http
Repo: cyanheads/cisa-cybersecurity-mcp-server
Repo updated: Oct 14, 2026

Install command

mcp add io.github.cyanheads/cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcp

Install method: streamable-http

Review the upstream source before running this command.

GitHub project

Quality

Repo stars

Repo updated

Oct 14, 2026

How is this score calculated?

Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.

MCP manifest

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-14T21:31:06.737755Z",
      "publishedAt": "2026-10-14T21:31:06.737755Z",
      "statusChangedAt": "2026-10-14T21:31:06.737755Z"
    }
  },
  "server": {
    "name": "io.github.cyanheads/cisa-cybersecurity-mcp-server",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://cisa-cybersecurity.caseyjhand.com/mcp",
        "type": "streamable-http"
      }
    ],
    "version": "0.3.2",
    "packages": [
      {
        "version": "0.3.2",
        "transport": {
          "type": "stdio"
        },
        "identifier": "@cyanheads/cisa-cybersecurity-mcp-server",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "environmentVariables": [
          {
            "name": "MCP_LOG_LEVEL",
            "format": "string",
            "default": "info",
            "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
          },
          {
            "name": "CISA_KEV_REFRESH_CRON",
            "format": "string",
            "default": "*/30 * * * *",
            "description": "Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup."
          },
          {
            "name": "CISA_CSAF_MIRROR_PATH",
            "format": "string",
            "description": "Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows."
          },
          {
            "name": "CISA_CSAF_MIRROR_AUTO_INIT",
            "format": "string",
            "default": "true",
            "description": "Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band."
          },
          {
            "name": "CISA_CSAF_REFRESH_CRON",
            "format": "string",
            "default": "17 */6 * * *",
            "description": "Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup."
          },
          {
            "name": "CISA_VULNRICHMENT_CACHE_TTL_SECONDS",
            "format": "string",
            "default": "21600",
            "description": "Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value."
          },
          {
            "name": "CISA_FEED_CACHE_TTL_SECONDS",
            "format": "string",
            "default": "900",
            "description": "Seconds a parsed RSS feed window stays cached."
          },
          {
            "name": "CISA_HTTP_TIMEOUT_MS",
            "format": "string",
            "default": "30000",
            "description": "Per-request timeout in milliseconds for every upstream fetch."
          }
        ]
      },
      {
        "version": "0.3.2",
        "transport": {
          "url": "http://localhost:3010/mcp",
          "type": "streamable-http"
        },
        "identifier": "@cyanheads/cisa-cybersecurity-mcp-server",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "environmentVariables": [
          {
            "name": "MCP_TRANSPORT_TYPE",
            "value": "http",
            "format": "string",
            "description": "Selects the HTTP transport."
          },
          {
            "name": "MCP_HTTP_HOST",
            "format": "string",
            "default": "127.0.0.1",
            "description": "The hostname for the HTTP server."
          },
          {
            "name": "MCP_HTTP_PORT",
            "format": "string",
            "default": "3010",
            "description": "The port to run the HTTP server on."
          },
          {
            "name": "MCP_HTTP_ENDPOINT_PATH",
            "format": "string",
            "default": "/mcp",
            "description": "The endpoint path for the MCP server."
          },
          {
            "name": "MCP_AUTH_MODE",
            "format": "string",
            "default": "none",
            "description": "Authentication mode to use: 'none', 'jwt', or 'oauth'."
          },
          {
            "name": "MCP_LOG_LEVEL",
            "format": "string",
            "default": "info",
            "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
          },
          {
            "name": "CISA_KEV_REFRESH_CRON",
            "format": "string",
            "default": "*/30 * * * *",
            "description": "Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup."
          },
          {
            "name": "CISA_CSAF_MIRROR_PATH",
            "format": "string",
            "description": "Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows."
          },
          {
            "name": "CISA_CSAF_MIRROR_AUTO_INIT",
            "format": "string",
            "default": "true",
            "description": "Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band."
          },
          {
            "name": "CISA_CSAF_REFRESH_CRON",
            "format": "string",
            "default": "17 */6 * * *",
            "description": "Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup."
          },
          {
            "name": "CISA_VULNRICHMENT_CACHE_TTL_SECONDS",
            "format": "string",
            "default": "21600",
            "description": "Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value."
          },
          {
            "name": "CISA_FEED_CACHE_TTL_SECONDS",
            "format": "string",
            "default": "900",
            "description": "Seconds a parsed RSS feed window stays cached."
          },
          {
            "name": "CISA_HTTP_TIMEOUT_MS",
            "format": "string",
            "default": "30000",
            "description": "Per-request timeout in milliseconds for every upstream fetch."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/cyanheads/cisa-cybersecurity-mcp-server",
      "source": "github"
    },
    "description": "CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless."
  }
}

Report an issue with this listing