How to Build a Local Security Intelligence Workstation with Claude and MCP

The 2 AM CVE Alert: How to Build a Local Security Intelligence Workstation with Claude and MCP

Last week, our team received a high-severity CVE alert. My first instinct was muscle memory: open the browser, check the CVSS score on NVD, switch to CISA KEV to see if it's actively exploited, look up EPSS for exploit probability, search GitHub for PoCs, and finally check VirusTotal for related samples. It took half an hour just to mentally piece everything together.

What if you have to handle 50 alerts a day? That's not a job for a human.

In this 15-minute tutorial, I'll show you how to build a local security intelligence workstation using the open-source cve-mcp-server. By leveraging the MCP (Model Context Protocol), you can enable Claude to directly query 24+ security data sources. Ask one question, and it will run parallel queries across all sources in the background, returning a structured risk assessment. The days of keeping 15 browser tabs open are over.

Prerequisites

• Python 3.10 or higher (3.11/3.12 recommended)
• A terminal (macOS/Linux Terminal or Windows PowerShell)
• Claude Desktop or Claude Code CLI (either works)
• No paid API keys required for the initial setup—8 core tools work out of the box.

Step 1: Clone and Install

Open your terminal and run:

git clone https://github.com/mukul975/cve-mcp-server.git
cd cve-mcp-server

## Create a virtual environment (best practice to keep global dependencies clean)
python -m venv venv
source venv/bin/activate        # macOS / Linux
## .\venv\Scripts\Activate.ps1   # Windows PowerShell

## Install the project and its dependencies
pip install -e .

Why use the -e flag? It stands for pip install --editable, which installs the package in "development mode". Any local changes you make to the source code take effect immediately without reinstalling—a lifesaver for debugging later.

Verify the server starts correctly:

python -m cve_mcp.server

If the terminal doesn't throw an error and just seems to "hang" (waiting for STDIO input, which is normal for MCP), the server started successfully. Press Ctrl+C to stop it.

Step 2: Configure Claude Desktop

This is the core of the tutorial—where the MCP protocol shines. Claude Desktop needs to know where to find our security tools server.

macOS users: Edit ~/Library/Application Support/Claude/claude_desktop_config.json
Windows users: Edit %APPDATA%\Claude\claude_desktop_config.json

Add the following configuration:

{
  "mcpServers": {
    "cve-mcp": {
      "command": "python",
      "args": ["-m", "cve_mcp.server"],
      "cwd": "/Users/your-username/cve-mcp-server"
    }
  }
}

Why absolute paths? Relative paths often fail because Claude Desktop's working directory changes depending on how it's launched. I learned this the hard way: ~/projects/cve-mcp-server won't work. You must use the expanded absolute path, e.g., /Users/zhouxiaoma/cve-mcp-server.

After saving the config, fully quit Claude Desktop (macOS: Cmd+Q, Windows: Alt+F4), then relaunch it. You'll see a 🔨 hammer icon next to the input box—this confirms the MCP tools are connected.

Using Claude Code CLI? Connect with one command:

claude mcp add cve-mcp -- python -m cve_mcp.server

Step 3: Quick Start (Zero API Keys)

Many developers dread the "API Key" setup. The good news: this project uses a progressive capability model. Eight core tools require zero API keys: CVE lookup, EPSS scoring, CISA KEV check, CWE info, CVSS parsing, MITRE ATT&CK mapping, OSV.dev dependency scanning, and ransomware queries.

Open Claude and ask:

"Look up CVE-2021-44228. Is it being actively exploited? How high is the risk?"

Claude will automatically call lookup_cve, get_epss_score, and check_kev_status in the background and compile the results for you. No manual tab switching required.

Step 4: Real-World Triage: Assess Log4Shell in One Click

Let's run a complete scenario. Assume you just received an alert for CVE-2021-44228 (Log4Shell) and need to triage it.

Type this into Claude:

"Use the triage_cve tool to perform a deep analysis of CVE-2021-44228, setting depth to 'deep'. Tell me the risk score, whether urgent patching is required, and the rationale."

Claude will invoke the triage_cve orchestrator, which runs the following in parallel:

1. Fetches CVSS scores and affected products from NVD
2. Retrieves exploit probability from FIRST EPSS
3. Checks if it's listed in the CISA KEV catalog
4. Searches for public PoC exploit code
5. Calculates a composite risk score: CVSS × 20% + EPSS × 35% + KEV × 30% + PoC × 15%
6. If depth=deep, outputs SSVC v2 qualitative decision support

You'll get a structured report like this:

Risk Score: 97/100 (CRITICAL)
  - CVSS 3.1: 10.0 (Remote Code Execution, no authentication)
  - EPSS Exploit Probability: 97.5% (Top 0.01% historically)
  - CISA KEV: ✅ Listed (Added 2021-12-10, known ransomware target)
  - Public PoC: ✅ 300+ repositories found

Recommendation: Urgent patching within 24-48 hours

Why does this scoring make sense? The formula weights EPSS highest (35%) because statistical exploit likelihood reflects real-world risk better than theoretical CVSS scores. CISA KEV gets 30%—it's hard evidence of active exploitation. KEV hits also trigger a hard override: if a CVE is in the KEV catalog, it's always flagged as CRITICAL with a minimum score of 76.

Step 5: Advanced Setup: Add NVD API Key for 10x Performance

By default, the free NVD API limits you to 5 requests per 30 seconds. For bulk CVE processing, this is slow. Register for a free NVD API Key at nvd.nist.gov to bump the limit to 50 requests per 30 seconds.

Create or edit a .env file in the project root:

echo 'NVD_API_KEY=your_nvd_api_key_here' > .env

Update your Claude Desktop config to include the env field:

{
  "mcpServers": {
    "cve-mcp": {
      "command": "python",
      "args": ["-m", "cve_mcp.server"],
      "cwd": "/your/absolute/path/cve-mcp-server",
      "env": {
        "NVD_API_KEY": "your_nvd_api_key_here"
      }
    }
  }
}

Fully quit and restart Claude Desktop to apply the changes.

FAQ & Troubleshooting

Q: The 🔨 hammer icon isn't showing in Claude?
Double-check your JSON syntax, especially path slashes (Windows requires \\ or forward slashes). Confirm you used an absolute path. Finally, ensure you fully quit Claude Desktop—minimizing isn't enough.

Q: NVD returns 403/503 errors?
NVD updated its API in late 2024, now mandating an API key for access. The free tier just requires an email confirmation. Add the key to .env and you're set. Without NVD, the other 7 zero-key tools work perfectly fine.

Q: Can I scan my project's dependencies?
Yes. Tell Claude: "Scan these Python dependencies: requests==2.28.0, flask==2.2.0, django==3.2.0". It will query OSV.dev against known vulnerability databases and suggest safe upgrades.

Q: Encoding errors on Windows?
Run these in PowerShell before starting the server:

$env:PYTHONUTF8 = "1"
$env:PYTHONIOENCODING = "utf-8"

Summary

Here's what we accomplished today:

1. Cloned and installed CVE MCP Server (3 mins)
2. Configured Claude Desktop's MCP connection to let AI call security tools directly
3. Performed zero-key CVE queries to experience multi-source intel aggregation
4. Used the triage_cve orchestrator for one-click Log4Shell risk assessment
5. Added an NVD API Key to boost query throughput by 10x

The core value of this workflow: You no longer need to toggle between 15 security intelligence sources. Send one prompt, let the backend query, correlate, and score everything in parallel, and receive an actionable, synthesized conclusion.

Next Steps

• Add Tier 2 API Keys (VirusTotal, Shodan, GreyNoise) to unlock IP reputation and malware analysis.
• Try the scan_dependencies tool by feeding it your requirements.txt or package-lock.json for automated security audits.
• Extend it yourself: Built on FastMCP, adding a new tool takes just a few lines. Register it in server.py using the @mcp.tool() decorator. An excellent hands-on exercise for backend devs learning MCP.

Time to close those 15 browser tabs.