cve-intel

# 🛡️ CVE Intel  **Local security intelligence in native Rust — a Tauri desktop app, a one-click built-in small AI model (llama.cpp), an MCP server for any harness, a REST API, and a plain CLI. 31 tools, 25 data sources. Private on-device AI by default; OpenAI, Anthropic or Gemini are an opt-in setting.** [](https://www.rust-lang.org) [](https://tauri.app) [](https://modelcontextprotocol.io) [](LICENSE) ## What is it? Security teams get a constant stream of new vulnerabilities (CVEs) and have to answer one question over and over: **"Do we need to fix this now, or can it wait?"** Answering it normally means opening NVD, EPSS, CISA KEV, GitHub, Shodan and a dozen other tabs and piecing the story together by hand. CVE Intel does that for you. Give it a CVE, an IP address, a file hash, a domain or a list of dependencies. It asks every relevant public source at the same time and gives back one prioritised, evidence-backed answer: *what it is, how risky it is, and whether to act now.* A risk score (0–100) is computed from severity, the chance of exploitation, and whether attackers are already using it — anything on the CISA KEV list is always CRITICAL. You can use it as a desktop app, from the command line, over a REST API, or plug it into an AI coding tool through MCP. You can also just ask in plain English (*"Should we patch CVE-2021-44228 this weekend?"*), and a small AI model explains the findings. By default that model runs **on your own machine**; if you prefer a stronger one you can switch to OpenAI, Anthropic (Claude) or Google Gemini in **Settings**. > It helps you decide what to patch. It does not scan your network or fix > anything for you, and results are only as current as the public sources. --- ## 📸 Screenshots The desktop app, showing live results from the real data sources (log4j, CISA KEV, EPSS, OSV.dev). Dark and light themes follow your system setting. **CVE Triage** (above): one lookup, one 0–100 risk score, and the evidence behind it. **Ask AI:** ask in plain English. The facts are looked up first, then a small model running on your machine explains them.  <table> <tr> <td width="50%"><b>Compare CVEs</b> — a patch-priority ranking<br/><img src="assets/screenshots/compare.png" alt="Compare CVEs ranking four KEV-listed CVEs by patch priority"/></td> <td width="50%"><b>Scan Dependencies</b> — known vulnerabilities from OSV.dev<br/><img src="assets/screenshots/scan.png" alt="Dependency scan listing vulnerable PyPI and npm packages"/></td> </tr> <tr> <td width="50%"><b>Databases</b> — every data source, its key status and cache<br/><img src="assets/screenshots/databases.png" alt="Databases view listing upstream sources such as NVD and EPSS"/></td> <td width="50%"><b>Light theme</b><br/><img src="assets/screenshots/triage-light.png" alt="CVE Triage for CVE-2024-3400 in the light theme"/></td> </tr> </table> --- ## 🧭 Real-world uses | Situation | What you do | |---|---| | **A new CVE is all over the news on a Friday.** Do we drop everything? | Ask *"Should we patch CVE-2024-3400 this weekend?"* or run `cve-intel triage CVE-2024-3400 --depth deep`. You get a score, whether it is in CISA KEV, the EPSS exploit probability, any public exploit code, and a clear urgency. | | **The vulnerability scanner just reported 40 findings.** Which first? | Paste the CVE IDs into **Compare CVEs** (or `cve-intel compare CVE-… CVE-…`) to get a ranked patch order instead of sorting by CVSS alone. | | **A strange IP shows up in your firewall or login logs.** | Paste it into **Quick Find** (`⌘K`) or run `cve-intel ip 185.220.101.34` for reputation from AbuseIPDB, GreyNoise, Shodan and more. Private/internal IPs are refused, never sent out. | | **Your EDR flags an unknown file.** | `cve-intel hash <sha256>` checks MalwareBazaar, VirusTotal and CIRCL hashlookup in one go. | | **Before a release:** are our dependencies safe? | Paste a `requirements.txt` / `package.json` / `pom.xml` into **Scan Dependencies**, or run it in CI (below). | | **You live in an AI coding tool** (Claude Code, Cursor, VS Code). | Add CVE Intel as an MCP server and ask your assistant about CVEs while it works in your repo. See [`examples/mcp/`](examples/mcp/). | | **You are new to vulnerability management.** | Ask *"Explain EPSS and CISA KEV like I'm new."* The Ask tab explains the evidence in plain language. | Fail a CI build when a dependency has a known vulnerability: ```bash cve-intel scan-deps requirements.txt | jq -e '.vulnerable_count == 0' ``` Get a machine-readable verdict for a ticket or dashboard: ```bash cve-intel triage CVE-2024-3400 --depth deep --json | jq '.risk | {risk_score, risk_label, urgency}' ``` --- ## ✨ The one-click local AI Small models are bad at raw tool-calling, so **Ask** is built in three layers: 1. **Deterministic pre-routing** — CVE IDs / IPs / hashes / domains in your question are detected and the right tools run *before* the model sees anything; results are injected as authoritative context. 2. **Grounded generation + tool loop** — the model explains the evidence and may request more tools (native llama.cpp calls plus a JSON-in-text fallback for tiny models; grammar failures retry as plain grounded chat). 3. **No-model fallback** — with no model running, Ask returns the structured tool findings. The app is fully useful before any download finishes. **One-click setup** (desktop Ask tab, or the CLI below) installs the official llama.cpp runtime for your OS/arch into `~/.cve-intel/bin/`, downloads a small GGUF model into `~/.cve-intel/models/`, and starts it on `127.0.0.1` only: | Model | Download | Min RAM | Notes | |---|---:|---:|---| | Qwen 2.5 1.5B Instruct (Q4_K_M) | ~1.0 GB | 4 GB | Fastest | | **Qwen 2.5 3B Instruct (Q4_K_M)** ★ | ~1.9 GB | 6 GB | Recommended default | | Llama 3.2 1B Instruct (Q4_K_M) | ~0.8 GB | 4 GB | Smallest | | Llama 3.2 3B Instruct (Q4_K_M) | ~2.0 GB | 6 GB | Strong chat | | Qwen 2.5 7B Instruct (Q4_K_M) | ~4.7 GB | 10 GB | Optional upgrade | Already have Ollama / LM Studio / your own llama-server? Point `CVE_LLM_BASE_URL` at any OpenAI-compatible endpoint instead. ### Optional: use a frontier model (OpenAI, Anthropic, Gemini) Want sharper answers than a 3B model can give? Open **Settings → AI provider**, pick **OpenAI**, **Anthropic (Claude)** or **Google Gemini**, choose a model and paste your own API key. **Save & use** turns it on and tests the key; switch back to the private model at any time. | Provider | Default model | Env var (alternative to saving a key) | |---|---|---| | OpenAI | `gpt-4o` | `OPENAI_API_KEY` | | Anthropic (Claude) | `claude-sonnet-4-5` | `ANTHROPIC_API_KEY` | | Google Gemini | `gemini-2.5-flash` | `GEMINI_API_KEY` | The model box accepts any model id your account can use, so newer models need no update to the app. From the CLI: `cve-intel ask "Should we patch CVE-2024-3400?" --provider anthropic`. - **It is off by default and opt-in.** While a cloud provider is selected, each question *plus the lookup results gathered for it* (CVE details and any IP, hash or domain you asked about) is sent to that vendor and is covered by their terms. The Ask tab shows a banner whenever this is on. - **Your key stays on your machine.** It is kept in the app's built-in SQLite database (`~/.cve-intel/settings.db`, owner-only permissions), is never shown again in the UI, and is never logged. Prefer not to store it? Set the env var instead. See [SECURITY.md](SECURITY.md). - **No extra SDK.** All three vendors offer an OpenAI-compatible chat API with tool calling, which the Ask agent already speaks, so a provider is just a fixed base URL, a model name and a key. Anthropic labels its OpenAI-compatible endpoint as intended mainly for evaluation; if you need Claude-specific features, use it through MCP in a Claude client. - The REST `/api/v1/ask` endpoint deliberately keeps using only the local / `CVE_LLM_BASE_URL` model, so a web page cannot spend your cloud key. --- ## 🚀 Quick start ### Download and run (one file per platform) Grab the file for your OS from the [latest release](https://github.com/Fazmin/cve-intel/releases/latest). It is the whole product: the desktop app, the `cve-intel` CLI, the MCP server and the REST API are **one executable**. There is nothing else to install. | OS | Download | Run | |---|---|---| | Windows | `CVE-Intel_<version>_windows-x64-setup.exe` (or `…-portable.exe`, no install) | Run the installer, then open **CVE Intel** | | macOS (Apple Silicon + Intel) | `CVE-Intel_<version>_macos-universal.dmg` | Drag **CVE Intel** to Applications | | Linux | `CVE-Intel_<version>_linux-x64.AppImage` (or `.deb`) | `chmod +x` the file and run it | Each file has a `.sha256` next to it. The builds are not code-signed yet, so Windows SmartScreen and macOS Gatekeeper warn on first launch (macOS: right-click the app, **Open**). The same executable is also the command line. Double-click opens the window; **any argument** runs it as the CLI, MCP server or REST server instead: ```bash # macOS (the app bundle's executable) "/Applications/CVE Intel.app/Contents/MacOS/cve-intel" triage CVE-2024-3400 "/Applications/CVE Intel.app/Contents/MacOS/cve-intel" mcp # MCP over stdio "/Applications/CVE Intel.app/Contents/MacOS/cve-intel" serve # MCP /mcp + REST /api/v1 # Linux AppImage: ./CVE-Intel_<version>_linux-x64.AppImage mcp # Windows (default per-user install): # "%LOCALAPPDATA%\CVE Intel\cve-intel.exe" mcp ``` > On Windows the executable is a windowed program, so a terminal does not wait > for it: use `start /wait "" "…\cve-intel.exe" triage CVE-2024-3400` (or > PowerShell `& "…\cve-intel.exe" … | Out-Host`) to see ordered output. MCP > clients start it directly and are unaffected. ### Desktop app (from source) ```bash cargo build -p cve-intel-desktop ./target/debug/cve-intel-desktop ``` For the installable bundle you would download above (`.dmg` / `.exe` / `.AppImage`): ```bash cargo install tauri-cli --version "^2" --locked cd apps/desktop/src-tauri && cargo tauri build ``` Views: **Ask AI** (chat with tool-use chips), **CVE Triage** (risk gauge, CVSS/EPSS/KEV/PoC cards, SSVC decision), **Compare CVEs**, **Scan Dependencies**, **Databases** (insight into every source — see below), **Local Model** (one-click runtime/models), **Settings** (choose the private model or OpenAI / Anthropic / Gemini), **System** (health). Press **⌘K** anywhere for Quick Find — paste a CVE, IP, hash, domain, URL or `package:ecosystem:version` and it routes itself. ### CLI (no harness, no GUI) ```bash cargo run -p cve-server -- ask "Should we patch CVE-2021-44228?" --model qwen2.5-3b cargo run -p cve-server -- triage CVE-2024-3400 --depth deep cargo run -p cve-server -- quick-find 185.220.101.34 cargo run -p cve-server -- scan-deps requirements.txt cargo run -p cve-server -- compare CVE-2024-3400 CVE-2023-44487 cargo run -p cve-server -- sources --probe # every database, live status ``` ### Any MCP harness MCP is an open protocol — this is not Claude-specific. Ready-made configs for Claude Code, Claude Desktop, Cursor and VS Code are in [`examples/mcp/`](examples/mcp/). **From the desktop app:** open **MCP Server** in the sidebar. You can start and stop an MCP server on `http://127.0.0.1:<port>/mcp` (port 8000 by default, with an option to start it when the app opens), and copy setup steps for Claude Code, Cursor, VS Code, Claude Desktop, Windsurf or any other client. The steps cover connecting to that server, or having the agent launch its own copy over stdio, which works even when the app is closed. The app's server listens on loopback only and refuses requests from web pages. ```bash # Using the downloaded app (path for macOS; see "Download and run" for others): claude mcp add cve-intel -- "/Applications/CVE Intel.app/Contents/MacOS/cve-intel" mcp # Or build the headless binary (no GUI, e.g. for servers / Docker): cargo build --release -p cve-server claude mcp add cve-intel -- /absolute/path/to/target/release/cve-intel mcp # shared/remote: cve-intel serve → MCP at /mcp, REST at /api/v1 (127.0.0.1:8000) ``` The server exposes 31 tools, resources (`kev://catalog`, `epss://scores/{cve_id}`, `manifest://tool-hash`) and prompts (`patch_decision`, `compare_and_prioritize`, `dependency_triage`). It **never** registers a sampling handler or issues `sampling/createMessage`. --- ## 🗄️ Insight into every database The desktop **Databases** view (CLI: `cve-intel sources --probe`, REST: `GET /api/v1/sources`, MCP: `get_data_sources`) covers all 25 upstream sources — what each provides, its endpoint, auth/free tier, whether your key is configured, cache TTL and which tools consume it — with a one-click live connectivity probe (status, HTTP code, latency for all 25), plus the on-machine stores: SQLite cache statistics with per-family breakdown and clear-cache, downloaded models, and the llama.cpp runtime. | Category | Sources | |---|---| | Vulnerability intelligence | NVD, EPSS (FIRST), CISA KEV, VulnCheck NVD++, MSRC, Red Hat, Ubuntu | | Exploit intelligence | GitHub PoC search, Exploit-DB, Nuclei templates | | Network intelligence | AbuseIPDB, GreyNoise, Shodan, crt.sh, CIRCL Passive DNS | | Threat intelligence | VirusTotal, MalwareBazaar, ThreatFox, URLScan, Ransomwhere, CIRCL hashlookup | | DevSecOps / reference | OSV.dev, GitHub Advisories, MITRE ATT&CK (STIX), HIBP Pwned Passwords | Eight-plus tools need **no API key at all** (EPSS, KEV, OSV, CVSS, ATT&CK, crt.sh, Ransomwhere, hashlookup, pwned passwords, NVD at low rate). ### 🔑 Adding optional API keys Keys are never required, but each one unlocks more or raises a rate limit. **Add them right in the app:** open **Settings → Data source API keys**, press **Get a key** to open the service's sign-up page, paste the key and press **Save**. It takes effect on your next lookup, with no restart. The **Databases** view also shows a *Get a key* button on every source that takes one. | Key | What it unlocks | Get it here | |---|---|---| | NVD API key | 10× faster CVE lookups | [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key) | | GitHub token (no scopes) | Public exploit search, advisories (5,000 vs 60 requests/hour) | [github.com/settings/tokens](https://github.com/settings/tokens) | | VulnCheck token | Backup CVE data if NVD is down | [vulncheck.com/community](https://www.vulncheck.com/community) | | AbuseIPDB key | IP abuse score | [abuseipdb.com/api](https://www.abuseipdb.com/api) | | GreyNoise key | Is this IP harmless background noise? | [GreyNoise API docs](https://docs.greynoise.io/docs/using-the-greynoise-community-api) | | Shodan key | Open ports and services on an IP | [account.shodan.io](https://account.shodan.io) | | VirusTotal key | 70+ antivirus verdicts for a file hash | [virustotal.com/gui/my-apikey](https://www.virustotal.com/gui/my-apikey) | | URLScan key | Higher limits for URL checks | [urlscan.io/docs/api](https://urlscan.io/docs/api/) | | abuse.ch Auth-Key | MalwareBazaar and ThreatFox lookups | [auth.abuse.ch](https://auth.abuse.ch/) | | CIRCL passive DNS login | Historical DNS records | [circl.lu/services/passive-dns](https://www.circl.lu/services/passive-dns/) (access is by request) | **From the command line** (handy on servers, or if you never open the desktop app): ```bash cve-intel keys list # which keys are set and where from (never prints values) cve-intel keys links # where to get each key cve-intel keys set SHODAN_KEY # hidden prompt, so the key stays out of shell history echo "$KEY" | cve-intel keys set SHODAN_KEY # or pipe it in from a script cve-intel keys remove SHODAN_KEY ``` Free tiers and sign-up steps are the vendors' to change, so check their pages. Keys are stored in the app's built-in SQLite database (`~/.cve-intel/settings.db`, owner-only permissions) and are shared with the `cve-intel` CLI, MCP server and REST API on the same machine. A key saved in the app wins over one in your environment. You can still use [`.env.example`](.env.example) / environment variables instead (the way to go for Docker and servers). See [SECURITY.md](SECURITY.md) for how keys are handled. --- ## 📊 Risk score ``` Risk = CVSS×0.20 + EPSS×0.35 + KEV×0.30 + PoC×0.15 (boosters up to ×1.27, capped at 100) ``` - **KEV hard override:** a CISA KEV-listed CVE is confirmed exploited in the wild, so it is always **CRITICAL** with score **≥ 76**. - EPSS carries the exploitation-probability signal; CVSS is treated as severity, not likelihood. `depth="deep"` triage also emits the **SSVC v2** CISA Deployer decision (`Act / Attend / Track* / Track`). - Bands: 0–25 LOW · 26–50 MEDIUM · 51–75 HIGH · 76–100 CRITICAL. --- ## 🏗️ Architecture ``` crates/cve-core Harness-agnostic engine: 25 source clients, risk scorer, SSVC, CVSS, validators, SQLite cache + settings DB, source catalog, llama.cpp manager, cloud-provider settings + Ask agent. No MCP/Tauri/CLI types. crates/cve-server `cve-intel` binary: MCP (stdio + streamable HTTP), REST (/api/v1), and the CLI — thin adapters over cve-core. apps/desktop Tauri app linking cve-core natively (no sidecar needed for intelligence; llama-server is the only child process). examples/mcp Client configs for common MCP harnesses. ``` All traffic is outbound HTTPS to the intelligence sources (plus the model downloads you explicitly click, and the AI provider you opt in to, if any). API keys (intelligence sources and cloud AI) come from the Settings database or from the environment/`.env`. No key is ever logged, cached, shown in the UI, or returned by any tool. Private/reserved IPs are rejected before any network lookup. The local model server binds loopback only. Two small embedded SQLite files, both created on first use: `cache.db` (disposable lookup cache) and `~/.cve-intel/settings.db` (your API keys and AI provider choice, kept separate so clearing the cache never touches them). ### Docker (headless MCP-over-HTTP + REST) ```bash docker build -t cve-intel . docker run --rm -p 127.0.0.1:8000:8000 --env-file .env cve-intel ``` --- ## ⚙️ Configuration Easiest in the desktop app: **Settings → Data source API keys** (see [Adding optional API keys](#-adding-optional-api-keys)). For headless use, copy [`.env.example`](.env.example) to `.env` and add keys as you need them. Everything degrades gracefully without them. Notable variables: `NVD_API_KEY`, `GITHUB_TOKEN`, `VULNCHECK_TOKEN`, `ABUSEIPDB_KEY`, `VIRUSTOTAL_KEY`, `SHODAN_KEY`, `GREYNOISE_API_KEY`, `URLSCAN_KEY`, `CIRCL_PDNS_USER/PASS`, `ABUSECH_AUTH_KEY`, the optional cloud-AI keys `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, plus `CACHE_DB_PATH`, `CVE_INTEL_HOME`, `CVE_LLM_BASE_URL`, `LLAMA_SERVER_BIN`, `HOST`/`PORT` (for `cve-intel serve`). ## 🧪 Development ```bash cargo test -p cve-core -p cve-server # unit tests: scorer, SSVC, CVSS, validators, cache, parsers, agent routing, source catalog cargo build --release # cve-intel + desktop binary ``` ## 📚 Citing and attribution ### Citing information from CVE Intel in a report or ticket CVE Intel gathers facts from public sources; it is not the source itself. When you write up a decision (a patch ticket, an audit note, a post-incident review), cite the **primary source and the date you looked**, not the app or the AI's wording: > *Example (illustrative values):* CVE-2021-44228: CVSS 10.0 (NVD); listed in > CISA KEV, added 2021-12-10 (CISA); EPSS 0.94 as of 2026-10-18 (FIRST). > Retrieved 2026-10-18 with CVE Intel 0.2.1, scoring v1.0. - **Scores change.** EPSS updates daily, KEV grows, NVD is revised. Always record the retrieval date. Results are cached for minutes to hours, and up to a day for some feeds (the **Databases** view shows each source's cache time). - **The risk score is ours.** The 0–100 number is CVE Intel's own composite (see [Risk score](#-risk-score)). Cite it as *"CVE Intel risk score (scoring v1.0)"* and quote the underlying CVSS, EPSS and KEV values next to it. `cve-intel health` and the **System** view show the version. - **An AI answer is not evidence.** Local or cloud, a model can be wrong. Cite the data shown beside the answer (score, KEV, EPSS, PoC), and check it against the source before acting. ### Citing this software ```bibtex @software{cve_intel, title = {CVE Intel: local security intelligence for CVE triage}, author = {{CVE Intel contributors}}, year = {2026}, version = {0.2.1}, url = {https://github.com/Fazmin/cve-intel}, license = {MIT}, note = {Native Rust desktop app, CLI, MCP server and REST API} } ``` Repository: [github.com/Fazmin/cve-intel](https://github.com/Fazmin/cve-intel). Please also add that URL and use the version you ran (`cve-intel --version`). See [License](#-license). ### Data sources: credit and terms CVE Intel only *queries* these services; it does not own or republish their data. Their terms apply to anything you copy out of the app, so check each provider's current terms, especially before commercial use or redistribution. The notes below are a starting point, not legal advice. | Source | What to credit / know | |---|---| | **NVD** (NIST) | NVD asks products that use its API to say they are not endorsed or certified by the NVD. The usual wording is *"This product uses data from the NVD API but is not endorsed or certified by the NVD."* Confirm the current text on NVD's [terms of use](https://nvd.nist.gov/developers/terms-of-use). | | **EPSS** (FIRST) | Attribute FIRST and link [first.org/epss](https://www.first.org/epss/); see their usage terms there. | | **CVSS** (FIRST) | Standard by FIRST: [first.org/cvss](https://www.first.org/cvss/). | | **CISA KEV** | U.S. government catalog: [cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Credit CISA. | | **SSVC** decision | Stakeholder-Specific Vulnerability Categorization by CERT/CC and CISA: [github.com/CERTCC/SSVC](https://github.com/CERTCC/SSVC). | | **MITRE ATT&CK®** | ATT&CK is a registered trademark of The MITRE Corporation; see the [terms of use](https://attack.mitre.org/resources/terms-of-use/). | | **OSV.dev**, **GitHub Advisory Database** | Open data with attribution requirements that vary by database (the GitHub Advisory Database is CC BY 4.0). See [osv.dev](https://osv.dev) and [github.com/advisories](https://github.com/advisories). | | **abuse.ch** (MalwareBazaar, ThreatFox) | Community data; see [abuse.ch](https://abuse.ch). | | Others (VirusTotal, Shodan, AbuseIPDB, GreyNoise, URLScan, VulnCheck, CIRCL, Red Hat, Ubuntu, Microsoft MSRC, crt.sh, Exploit-DB, Ransomwhere, HIBP) | Each has its own terms and rate limits. The **Databases** view lists every source and its host; free tiers are often for non-commercial or limited use. | **Local AI models** you download are not part of this project and carry their own licences (for example the Llama 3.2 Community License, and Qwen models whose licence differs by size). Read the model's page before using it commercially. The model files come from the official Hugging Face repos listed in `crates/cve-core/src/llm.rs`, and the runtime is [llama.cpp](https://github.com/ggml-org/llama.cpp) (MIT). ## 🤝 Community - [CONTRIBUTING.md](CONTRIBUTING.md) — how to set up, what we look for in a PR - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) — how we treat each other - [SECURITY.md](SECURITY.md) — how to report a vulnerability privately ## 📄 License MIT — see [LICENSE](LICENSE).