Cisa Cybersecurity MCP Server
by cyanheadsio.github.cyanheads/cisa-cybersecurity-mcp-serverv0.3.0
CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.
context tax
queued
security
queued
cold start
queued
freshness
Active14d ago
Install Cisa Cybersecurity MCP server
Install in Claude Code
claude mcp add cisa-cybersecurity -- npx -y @cyanheads/cisa-cybersecurity-mcp-server run start:stdioInstall in Cursor
{
"mcpServers": {
"cisa-cybersecurity": {
"command": "npx",
"args": [
"-y",
"@cyanheads/cisa-cybersecurity-mcp-server",
"run",
"start:stdio"
]
}
}
}Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project).
Install in Claude Desktop
{
"mcpServers": {
"cisa-cybersecurity": {
"command": "npx",
"args": [
"-y",
"@cyanheads/cisa-cybersecurity-mcp-server",
"run",
"start:stdio"
]
}
}
}Settings → Developer → Edit Config (claude_desktop_config.json), then restart.
Install in VS Code
{
"servers": {
"cisa-cybersecurity": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@cyanheads/cisa-cybersecurity-mcp-server",
"run",
"start:stdio"
]
}
}
}Add to .vscode/mcp.json in your workspace.
Install in Windsurf
{
"mcpServers": {
"cisa-cybersecurity": {
"command": "npx",
"args": [
"-y",
"@cyanheads/cisa-cybersecurity-mcp-server",
"run",
"start:stdio"
]
}
}
}Add to ~/.codeium/windsurf/mcp_config.json.
Configuration
| Variable | Required | Secret | Description |
|---|---|---|---|
| MCP_LOG_LEVEL | — | — | Sets the minimum log level for output (e.g., 'debug', 'info', 'warn'). |
| CISA_KEV_REFRESH_CRON | — | — | Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup. |
| CISA_CSAF_MIRROR_PATH | — | — | Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows. |
| CISA_CSAF_MIRROR_AUTO_INIT | — | — | Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band. |
| CISA_CSAF_REFRESH_CRON | — | — | Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup. |
| CISA_VULNRICHMENT_CACHE_TTL_SECONDS | — | — | Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value. |
| CISA_FEED_CACHE_TTL_SECONDS | — | — | Seconds a parsed RSS feed window stays cached. |
| CISA_HTTP_TIMEOUT_MS | — | — | Per-request timeout in milliseconds for every upstream fetch. |
| MCP_HTTP_HOST | — | — | The hostname for the HTTP server. |
| MCP_HTTP_PORT | — | — | The port to run the HTTP server on. |
| MCP_HTTP_ENDPOINT_PATH | — | — | The endpoint path for the MCP server. |
| MCP_AUTH_MODE | — | — | Authentication mode to use: 'none', 'jwt', or 'oauth'. |
Remote endpoints
- streamable-http
https://cisa-cybersecurity.caseyjhand.com/mcp
Freshness
Active — last maintenance signal 14d ago. The newest of the signals below sets the band.
Last commit (default branch)
2026-09-25 · 14d ago · GitHub
Latest release
2026-09-25 · 14d ago · GitHub · v0.3.0
Package published
no data · npm/PyPI
Registry entry updated
2026-09-25 · 14d ago · official registry · v0.3.0
FAQ
›How do I install the Cisa Cybersecurity MCP server in Claude Code?
Run: claude mcp add cisa-cybersecurity -- npx -y @cyanheads/cisa-cybersecurity-mcp-server run start:stdio. For Cursor, VS Code, Claude Desktop and Windsurf, use the install tabs above.
›Does Cisa Cybersecurity require an API key?
No required environment variables are declared in its published metadata.
›Can I use Cisa Cybersecurity as a remote (hosted) MCP server?
Yes — it offers both a hosted endpoint and a local stdio package.
›Is Cisa Cybersecurity in the official MCP registry?
Yes, as io.github.cyanheads/cisa-cybersecurity-mcp-server.