CVE Intel

Know which vulnerabilities matter, and what to do about them.
A private desktop app for vulnerability triage, written in native Rust, with a CLI, REST API and MCP server for developers and AI agents.
36 tools, 38 data sources, on-device AI.

What it is · Getting started · Features · Install · Local AI · Data sources · Developer notes · Citing

_{Screenshots are taken on a 2560×1440 screen. Click one to see it full size.}

Thousands of software vulnerabilities are published every year, each with an ID such as CVE-2024-3400. For every one of them, security, IT and development teams face the same question: does this affect us, and do we fix it now or can it wait? Answering it usually means checking NVD, CISA, FIRST, GitHub and vendor advisories by hand, one browser tab at a time.

CVE Intel does that legwork for you. Give it a vulnerability ID, your project's dependency list, or a suspicious IP address, file hash or domain. It checks up to 38 public security sources at once and comes back with one clear, evidence-backed answer: what it is, how risky it is, whether attackers are already using it, and what to do next. It also shows what changed this week across those sources, and can watch the vendors, products and packages you run.

It runs on your own computer as a desktop app. There is no CVE Intel account or server: lookups go straight from your machine to the public sources, and the built-in AI assistant runs locally unless you choose a cloud provider. The same program also works from the command line, as a REST API, and as an MCP server for AI agents (see Developer notes). It is built for security analysts, IT and operations teams, developers checking their dependencies, and anyone learning vulnerability management.

• Decide whether to patch now. Enter a CVE ID and get a risk score from 0 to 100, a plain recommendation and how urgent it is, with the evidence behind it.
• Put a list of vulnerabilities in order. Paste up to 10 CVE IDs from a scanner report and get the order to patch them in.
• Check your project's dependencies. Paste a lockfile or SBOM and see which packages have known vulnerabilities and which version fixes them.
• See what affects the products you run. List the known vulnerabilities for a product and version, such as Apache Tomcat 9.0.80, with actively exploited ones first.
• See what changed this week. Open Landscape for new CISA KEV entries, CVEs ENISA marks exploited that KEV does not list yet, rising EPSS scores, new Metasploit modules and PoCs, new critical CVEs, Project Zero's in-the-wild zero-days and the latest CISA advisories. CVEs that several sources agree on are listed first.
• Watch the products you run. Add a vendor, product, package or CVE to the local watchlist. Each refresh records what changed: new CVEs, KEV listings, EPSS jumps, new exploits, CVSS revisions and newly available fixes.
• Keep an eye on what attackers are exploiting. Filter CISA's catalog of actively exploited vulnerabilities by vendor, product, ransomware use or date.
• Investigate something suspicious. Check an IP address from your logs, a file hash your antivirus flagged, or an unfamiliar domain or URL against threat-intelligence sources.
• Ask questions in plain English. "Should we patch CVE-2024-3400 this weekend?" The AI assistant looks up the facts first, then explains them, and shows which sources it used.
• Give AI coding assistants the same knowledge. Claude Code, Cursor, VS Code and other tools can use CVE Intel while they work, through MCP.

The risk score combines these signals: severity (CVSS), the chance of exploitation (EPSS), confirmed exploitation (CISA KEV) and public exploit code. Anything on CISA KEV is always CRITICAL. See Risk score for the formula.

CVE Intel helps you decide what to patch. It does not scan your network or apply fixes, and results are only as current as the public sources.

1. Download the app for your operating system and open it. The Landscape view loads first: what changed this week across the public sources.
2. Open CVE Triage, type a CVE ID such as CVE-2024-3400 and press Triage, or click one of the examples under the search box. Press Watch CVE (or Watch next to the vendor) to be told when it changes.
3. Press ⌘K (Ctrl+K on Windows and Linux) to open Quick Find. Paste anything there (a CVE, IP address, file hash, domain, URL or package:ecosystem:version) and CVE Intel picks the right lookup.
4. Optional: in Settings → Data source API keys, add free API keys for faster lookups and more exploit data. See API keys.
5. Optional: open Local Model and download a model to use Ask AI with answers that never leave your computer.
6. Optional: open MCP Server to connect your AI coding assistant.

Everything up to Developer notes is about the desktop app. To use CVE Intel from a terminal, a script, a CI pipeline or another program, go straight to that section.

What changed recently, from several independent sources at once: new CISA KEV entries (with ransomware flags and vendor counts), CVEs ENISA EUVD marks exploited that CISA KEV does not list, the largest EPSS rises, new or updated Metasploit modules and PoC-in-GitHub repositories, newly published critical NVD CVEs, Project Zero's in-the-wild zero-days and the latest CISA advisories. Each panel names its source and when it was fetched. CVEs that appear in two or more panels are listed first. Copy the briefing as Markdown for a ticket or weekly note. Ask "What's new this week?" in Ask AI for the same briefing.

Watch the vendors, products, packages and CVEs you run. Each refresh compares them with the last check and records what changed: new CVEs, KEV listings, ransomware use, EPSS jumps, new exploits or Metasploit modules, CVSS changes, newly available fixes and ENISA exploitation reports. The first check of an item records a silent baseline. The list lives only on this machine (~/.cve-intel/watch.db, owner-only). While the app is open it can refresh on a schedule (every 6 hours by default; change or turn it off in Settings). AI agents can read the watchlist over MCP but cannot change it.

One lookup across NVD, CVE.org, EPSS, CISA KEV, ENISA EUVD and public exploit sources. The result includes the risk score, a plain recommendation and urgency, and the evidence behind it: CVSS (and where it came from), 30-day EPSS probability and its recent trend, KEV dates, ENISA's exploited flag, CIRCL sightings (deep triage), and the exploit evidence found in Metasploit, Exploit-DB, Nuclei, GitHub, PoC-in-GitHub and, with a VulnCheck token, VulnCheck KEV and XDB. When NVD has not scored a CVE yet, the CNA's or CISA's score from the CVE.org record is used. Deep triage also returns a CISA SSVC decision, using CISA's own published SSVC assessment (Vulnrichment) where one exists. ENISA EUVD or VulnCheck KEV can raise SSVC Exploitation to active; they do not change the risk score. The interface follows your system's light or dark theme.

Ask questions such as "Which is worse: CVE-2024-3400 or CVE-2023-44487?" CVE Intel runs the right lookups first, then the model explains the results. Each answer lists the tools it used, so you can check where the facts came from.

Paste 2 to 10 CVE IDs to compare them and get a patch order based on KEV status, score, EPSS and exploit evidence, not on CVSS alone. CISA KEV CVEs come first, then the risk score. Equal scores are common (exploited CVEs with a high EPSS all reach 100), so ties are broken by known ransomware use, EPSS, exploit maturity, CVSS and the earlier KEV due date. Each CVE says why it sits above the next one.

• Side by side: one column per CVE, with rows for the score's parts, KEV dates, ransomware use, who reports exploitation, EPSS and its 30-day trend, exploit sources, CVSS attack vector, complexity, privileges, user interaction and impact, product, CWE and age. Riskier values that differ are in red. Only rows that differ hides the rest.
• What they have in common: CVEs in the same product (one update may cover them) or from the same vendor, ransomware use, exploitation reported outside CISA KEV (which the score doesn't count), network access without sign-in or user action, public exploits, rising EPSS, and shared weaknesses.

Drop a project folder or dependency files anywhere on the window, or use Choose folder… / Choose files…. A folder is searched, including subfolders, for the lockfiles, manifests and SBOMs listed below. The search skips node_modules, virtualenvs, vendor, build output and hidden folders, and skips a package.json or go.sum that sits next to the lockfile that pins it. Each file found is listed with its format and package count. Untick any you don't want, then press Scan. Every file is parsed on its own, a package listed in several files is checked once, and each finding names the files it came from. Files are read on your machine; only package names and versions are sent to OSV.dev.

You can also paste a lockfile (package-lock.json, yarn.lock, Pipfile.lock, poetry.lock, uv.lock, Cargo.lock, go.sum, go.mod, composer.lock, Gemfile.lock), an SBOM (CycloneDX JSON or XML, SPDX JSON or tag-value), a requirements.txt, package.json or pom.xml, purls, or name:ecosystem:version lines (for example from apk info -v or dpkg -l; Alpine needs its release, as in openssl:Alpine:v3.19:3.1.4-r0). The format is detected automatically and up to 10,000 packages are checked against OSV.dev. Each vulnerable package is listed with its advisories, their severity and the version that fixes them. In a CI pipeline the same scan can fail the build or feed GitHub code scanning; see CI and automation.

See every upstream source: what it provides, whether it needs a key, whether your key is set, how long results are cached, and which tools use it. Press Check connectivity to probe all of them live. The view also shows the local cache, downloaded models and the model runtime.

Give AI agents CVE Intel's 36 tools while they work. Start the server from the app, choose your agent, and copy setup steps with the correct address and executable path already filled in. Guides are included for Claude Code, Cursor, VS Code, Claude Desktop, Windsurf and any other MCP client.

• Two ways to connect. The agent can connect over HTTP to the server the app runs, or launch its own copy over stdio. The stdio option works even when the app is closed.
• Simple control. Start and stop the server, pick a port (8000 by default), and optionally start it whenever the app opens. The sidebar shows whether it is running.
• Local only. The server listens on 127.0.0.1 and refuses requests from web pages, so websites and other computers cannot use it.
• Uses your saved keys. Agents get the same data sources and API keys you configured in Settings.

To configure an agent by hand instead, see MCP server setup.

• Quick Find (⌘K or Ctrl+K): paste a CVE, IP, hash, domain, URL or package:ecosystem:version and CVE Intel picks the right lookup.
• Fixed versions: the version to upgrade a package to so that every known vulnerability is fixed, re-checked against OSV. Quick Find lodash:npm:4.17.15 to see it, or ask in Ask AI.
• Product and KEV search: every CVE affecting a product and version, exploited ones first, and filters over the CISA KEV catalog by vendor, product, ransomware use or date. Available in Ask AI, the CLI and MCP.
• MITRE ATT&CK mapping: curated CTID mappings for KEV-listed CVEs, plus techniques inferred from the CVE's weaknesses through CAPEC, labelled as inferred. Available to AI agents over MCP and through the REST API.
• IP, hash and domain intelligence from AbuseIPDB, GreyNoise, Shodan, VirusTotal, MalwareBazaar, crt.sh and more. Private and internal IPs are rejected before any lookup is made.
• Activity view: a searchable local history of your lookups, answers and the tool calls agents made, which you can pause or clear.
• Local Model view: install the runtime and download a model in one click.
• System view: health and version information.

¹ For these questions the model has to pick the right lookup itself, which larger local models and cloud providers do more reliably. The same searches are always available from the terminal (see Recipes).

Download the file for your OS from the latest release. The desktop app, CLI, MCP server and REST API are all one executable, with nothing else to install.

Each file has a .sha256 checksum next to it. Builds are not code-signed yet, so Windows SmartScreen and macOS Gatekeeper warn on first launch. On macOS, right-click the app and choose Open.

To build it yourself or run the headless server in Docker, see Build from source and Docker.

Ask AI uses a small language model that runs on your computer, so your questions stay private. Small models are poor at calling tools on their own, so Ask works in three layers:

1. Look up first. Before the model runs, CVE Intel finds the CVE IDs, IPs, hashes and domains in your question, runs the matching lookups, and gives the results to the model as facts it must rely on.
2. Explain the evidence. The model explains those results and can ask for more lookups. It uses native llama.cpp tool calls, with a JSON-in-text fallback for very small models. If structured output fails, the question is retried as plain chat grounded in the same results.
3. Works without a model. If no model is running, Ask returns the lookup results directly, so the app is useful before any download finishes.

Open the Local Model view to install a runtime and download a model, one click each. Every OS gets the official llama.cpp runtime, installed into ~/.cve-intel/bin/, with GGUF models in ~/.cve-intel/models/. On a Mac with Apple silicon (M1 or newer) the view also offers MLX, which runs the model on the Mac's GPU and answers noticeably faster: one click installs mlx-lm into a private Python environment in ~/.cve-intel/mlx/ (no system Python needed), and MLX models download into ~/.cve-intel/models/ too. Either model server runs on 127.0.0.1 only.

MLX models are listed only on Macs that can run them. If you already have mlx-lm (for example from Homebrew), CVE Intel uses it instead of installing its own.

Already running Ollama, LM Studio or your own llama-server? See Use your own model server.

For stronger answers, open Settings → AI provider, choose OpenAI, Anthropic or Google Gemini, pick a model and paste your API key. Save & use enables the provider and tests the key. You can switch back to the local model at any time.

The model field accepts any model ID your account can use.

• Off by default. When a cloud provider is selected, each question and the lookup results gathered for it are sent to that vendor under their terms. The Ask view shows a banner while this is on.
• Keys stay local. Keys are stored in ~/.cve-intel/settings.db with owner-only permissions. They are never shown again in the UI and never logged. You can use environment variables instead. See SECURITY.md.
• No vendor SDK. All three vendors offer an OpenAI-compatible chat API with tool calling. Anthropic describes its compatible endpoint as intended mainly for evaluation; for Claude-specific features, use CVE Intel through MCP in a Claude client.

The Databases view lists all 38 sources, and the CLI, REST API and MCP server report the same list.

Many tools need no API key at all: EPSS and its daily files, KEV, ENISA EUVD, CVE.org and CISA Vulnrichment, OSV, CVSS, Exploit-DB, Metasploit, PoC-in-GitHub, Project Zero, CISA advisories, CIRCL sightings, ATT&CK, CAPEC, crt.sh, Ransomwhere, hashlookup, Pwned Passwords, and NVD at a lower rate limit. Large feeds (EPSS daily files, Exploit-DB, Metasploit, ATT&CK, CAPEC, the CTID mappings) are downloaded once, reduced to a small index, and refreshed daily or every few hours.

Risk = CVSS×0.20 + EPSS×0.35 + KEV×0.30 + PoC×0.15   (boosters up to ×1.27, capped at 100)

• KEV override: a CVE in CISA KEV is confirmed exploited, so it is always CRITICAL with a score of at least 76. Only CISA KEV earns the KEV points and the override.
• EPSS measures the probability of exploitation. CVSS is treated as severity, not likelihood.
• PoC is the strongest public exploit evidence. A Metasploit exploit module counts as weaponized (the full 15 points); Exploit-DB entries and VulnCheck XDB exploits count as public exploits.
• Deep triage also returns the SSVC v2 CISA Deployer decision: Act, Attend, Track* or Track. Its inputs come from CISA's published SSVC assessment when there is one. Because that assessment is a snapshot, newer evidence can raise Exploitation: a CISA KEV, VulnCheck KEV or ENISA EUVD exploited listing, or an EPSS of 0.90 or more, makes it active. EUVD and VulnCheck do not change the risk score.
• Bands: 0–25 LOW, 26–50 MEDIUM, 51–75 HIGH, 76–100 CRITICAL.
• This is scoring version 1.1, reported as scoring_version in results.

Keys are optional. Each one unlocks more data or raises a rate limit. In the app, open Settings → Data source API keys, press Get a key to open the sign-up page, paste the key and press Save. The key is used on the next lookup, with no restart needed.

Keys are stored in ~/.cve-intel/settings.db with owner-only permissions and shared by the app, CLI, MCP server and REST API on the same machine. A key saved in the app takes precedence over an environment variable. Free tiers and sign-up steps are set by each vendor, so check their pages. To manage keys from a terminal or with environment variables, see Terminal configuration.

• All network traffic is outbound HTTPS: to the data sources, to the cloud AI provider if you opt in to one, and for the model and runtime downloads you start (Hugging Face, the llama.cpp release on GitHub and, for MLX, uv and a Python 3.12 build from GitHub plus mlx-lm from PyPI).
• API keys are never logged, cached, shown in the UI or returned by any tool.
• Private and reserved IPs are rejected before any network lookup.
• The local model server and the app's MCP server bind to loopback only.
• SQLite files are created on first use: cache.db, a disposable lookup cache; ~/.cve-intel/settings.db, which holds keys, provider settings and the watchlist auto-refresh interval; and ~/.cve-intel/watch.db, the local watchlist (items, snapshots and change events). Clearing the cache never touches settings or the watchlist.
• While the app is open, an optional background task can refresh the watchlist (every 6 hours by default). It only contacts the public sources needed for the items you watch, and you can turn it off in Settings. Nothing runs while the app is closed.
• The desktop app keeps an activity log in ~/.cve-intel/activity.db (owner-only). It records what you look up and ask, the answers, setting and model changes, the tools agents call through the app's MCP server, and which hosts each action contacted. API keys are never recorded, only key names. Upstream requests are stored as host and path, without query strings. Open Activity to search it, pause it or clear it. It keeps the latest 20,000 entries. The CLI and cve-intel mcp record nothing.

See SECURITY.md for the full security model and how to report a vulnerability.

Everything in this section is for using CVE Intel from a terminal, scripts, CI pipelines, other programs or AI agents, and for building it yourself. The desktop app needs none of it.

• The cve-intel executable: where it is and how one file runs every mode
• Command line (CLI): every command, with recipes for common tasks
• CI and automation: fail a build, upload SARIF to GitHub code scanning, JSON output
• REST API: endpoints and examples
• MCP server setup: connect AI agents by hand
• Terminal configuration: keys, environment variables, your own model server
• Build from source and Docker
• Architecture and Development and tests

The desktop app and the command-line tool are the same file. Double-clicking it opens the app; running it with any argument starts the CLI, the MCP server or the REST server instead.

# macOS
"/Applications/CVE Intel.app/Contents/MacOS/cve-intel" triage CVE-2024-3400
# Linux
./CVE-Intel_<version>_linux-x64.AppImage triage CVE-2024-3400
# Windows (default per-user install)
"%LOCALAPPDATA%\CVE Intel\cve-intel.exe" triage CVE-2024-3400

On Windows the executable is a windowed program, so the terminal does not wait for it. To see the output in order, use start /wait "" "…\cve-intel.exe" triage CVE-2024-3400, or in PowerShell & "…\cve-intel.exe" … | Out-Host. MCP clients start it directly and are not affected.

For servers and containers there is also a headless build without the GUI (cargo build --release -p cve-server, which produces target/release/cve-intel). From a source checkout, replace cve-intel with cargo run -p cve-server --. The examples below assume cve-intel is on your PATH.

cve-intel triage CVE-2024-3400 --depth deep
cve-intel ask "Should we patch CVE-2021-44228?" --model qwen2.5-3b
cve-intel quick-find 185.220.101.34
cve-intel scan-deps package-lock.json          # lockfile, SBOM or manifest; --sarif for code scanning
cve-intel fix lodash npm 4.17.15               # version that fixes every known vulnerability
cve-intel product confluence_data_center --vendor atlassian --version 8.5.0
cve-intel kev-search --vendor microsoft --ransomware-only --epss
cve-intel landscape --days 7                    # what's new; --markdown for a ticket
cve-intel watch add vendor fortinet
cve-intel watch refresh && cve-intel watch changes --unread
cve-intel compare CVE-2024-3400 CVE-2023-44487
cve-intel password-check                       # hidden prompt; only a 5-character hash prefix is sent to HIBP
cve-intel sources --probe                      # every data source, with live status

triage, fix, product, kev-search, landscape, watch, sources and ask print readable text; add --json for JSON. lookup, epss and kev print text, and the other lookup commands print JSON, ready for jq. Run cve-intel <command> --help for every option.

Fail a CI build when a dependency has a known vulnerability:

cve-intel scan-deps requirements.txt | jq -e '.vulnerable_count == 0'

Show the findings in GitHub code scanning (the Security tab and pull request annotations) by uploading SARIF:

# .github/workflows/dependencies.yml
on: [push, pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan the lockfile with CVE Intel
        run: cve-intel scan-deps package-lock.json --sarif > cve-intel.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: cve-intel.sarif
          category: cve-intel

This assumes cve-intel is on the runner's PATH (for example the release AppImage, or cargo build --release -p cve-server). Each vulnerability is a rule with an OSV link and a security-severity, and each result names the package, the advisory and the fixed version.

Get a machine-readable verdict for a ticket or dashboard:

cve-intel triage CVE-2024-3400 --depth deep --json | jq '.risk | {risk_score, risk_label, urgency}'

cve-intel serve starts an HTTP server on 127.0.0.1:8000 (set HOST and PORT to change it) with the REST API under /api/v1 and MCP at /mcp. The server the desktop app starts from MCP Server serves the same endpoints.

Errors return HTTP 400 with {"error": "…"}.

curl -s "http://127.0.0.1:8000/api/v1/triage/CVE-2024-3400?depth=deep" | jq '.risk'

curl -s -X POST http://127.0.0.1:8000/api/v1/tools/find_fixed_version \
  -H 'content-type: application/json' \
  -d '{"package": "lodash", "ecosystem": "npm", "version": "4.17.15"}'

curl -s -X POST http://127.0.0.1:8000/api/v1/tools/get_attack_mapping \
  -H 'content-type: application/json' -d '{"cve_id": "CVE-2024-34102"}'

• /api/v1/ask only uses the local model (or CVE_LLM_BASE_URL), never a cloud provider, so a caller cannot spend your cloud key.
• cve-intel serve has no authentication and allows cross-origin requests, so browser front ends can call it. That also means any web page open in your browser can reach it while it runs. Keep it on loopback, stop it when you're done, or put it behind your own authenticated reverse proxy. The server the desktop app starts refuses web pages instead (see below).

MCP is an open protocol and works with many clients, not only Claude. The easiest setup is the MCP Server view in the desktop app (see MCP server for AI agents). To configure it by hand:

# HTTP: connect to the server started from the app, or from `cve-intel serve`
claude mcp add --transport http cve-intel http://127.0.0.1:8000/mcp

# stdio: the agent launches its own copy (macOS app path shown)
claude mcp add cve-intel -- "/Applications/CVE Intel.app/Contents/MacOS/cve-intel" mcp

# stdio, using the headless binary
claude mcp add cve-intel -- /absolute/path/to/target/release/cve-intel mcp

Ready-made configs for Claude Code, Claude Desktop, Cursor, VS Code and other clients are in examples/mcp/.

The server exposes 36 tools, resources (kev://catalog, epss://scores/{cve_id}, manifest://tool-hash) and prompts (patch_decision, compare_and_prioritize, dependency_triage). It never registers a sampling handler or issues sampling/createMessage. Older tool names that duplicated other tools (prioritize_cves, check_exploit_availability, scan_container_packages, scan_repo_secrets) are no longer listed but still work. The watchlist tools (list_watchlist, get_watchlist_changes) are read-only: agents cannot add, remove or refresh items.

The server started from the app always binds to 127.0.0.1 and checks the Host, Origin and Sec-Fetch-Site headers to refuse cross-site browser requests, which protects against DNS rebinding. It has no sign-in, so any program on the same computer can use it with your saved keys. Stop it when you don't need it.

Manage API keys without the app:

cve-intel keys list                          # which keys are set and where from (never prints values)
cve-intel keys links                         # where to get each key
cve-intel keys set SHODAN_KEY                # hidden prompt, keeps the key out of shell history
echo "$KEY" | cve-intel keys set SHODAN_KEY  # or pipe it in from a script
cve-intel keys remove SHODAN_KEY

For headless use, copy .env.example to .env, or set environment variables. Everything works without keys, with fewer results. A key saved in the app takes precedence over an environment variable.

Set CVE_LLM_BASE_URL to any OpenAI-compatible endpoint, such as Ollama (http://127.0.0.1:11434/v1), LM Studio or your own llama-server, and optionally CVE_LLM_MODEL to the model name. Ask then uses it instead of the built-in runtime. To use a llama-server or mlx_lm.server you installed yourself, set LLAMA_SERVER_BIN or MLX_LM_SERVER_BIN to its path. To use a cloud provider from the CLI: cve-intel ask "Should we patch CVE-2024-3400?" --provider anthropic.

# Desktop app (debug)
cargo build -p cve-intel-desktop
./target/debug/cve-intel-desktop

# Installable bundle (.dmg / .exe / .AppImage)
cargo install tauri-cli --version "^2" --locked
cd apps/desktop/src-tauri && cargo tauri build

# Headless binary only (servers, Docker)
cargo build --release -p cve-server

Docker runs the headless MCP server over HTTP, plus the REST API:

docker build -t cve-intel .
docker run --rm -p 127.0.0.1:8000:8000 --env-file .env cve-intel

crates/cve-core     Harness-agnostic engine: 38 source clients, risk scorer,
                    SSVC, CVSS, validators, lockfile/SBOM parsers, SARIF
                    output, SQLite cache, settings DB, activity log and
                    watchlist, landscape briefing, source catalog,
                    llama.cpp and MLX manager, cloud-provider settings and
                    the Ask agent. No MCP, Tauri or CLI types.
crates/cve-server   The cve-intel binary: MCP (stdio and streamable HTTP),
                    REST (/api/v1) and the CLI, as thin adapters over cve-core.
apps/desktop        Tauri app linking cve-core and cve-server natively. The
                    same executable runs the GUI, the CLI and the MCP server,
                    and can host MCP over HTTP in-process. The model server
                    (llama-server, or mlx_lm.server on Apple silicon) is the
                    only child process.
examples/mcp        Client configs for common MCP clients.

cargo test -p cve-core -p cve-server   # scorer, SSVC, CVSS, validators, cache, parsers, agent routing, source catalog
cargo test -p cve-core -p cve-server -- --ignored   # live checks against the real sources (network)
cargo build --release                  # cve-intel and the desktop binary

See CONTRIBUTING.md for the full development setup and the checks CI runs.

CVE Intel gathers facts from public sources; it is not the source. When you record a decision, cite the primary source and the retrieval date, not the app or the AI's wording:

Example (illustrative values): CVE-2021-44228: CVSS 10.0 (NVD); listed in CISA KEV, added 2021-12-10 (CISA); EPSS 0.94 as of 2026-10-18 (FIRST). Retrieved 2026-10-18 with CVE Intel 0.3.0, scoring v1.1.

• Scores change. EPSS updates daily, KEV grows and NVD entries are revised. Results are cached for minutes to hours, and up to a day for some feeds. The Databases view shows each source's cache time.
• The risk score is CVE Intel's own. Cite it as "CVE Intel risk score (scoring v1.1)" alongside the underlying CVSS, EPSS and KEV values. cve-intel health and the System view show the version.
• An AI answer is not evidence. Local or cloud, a model can be wrong. Cite the data shown beside the answer and verify it against the source.

@software{cve_intel,
  title   = {CVE Intel: local security intelligence for CVE triage},
  author  = {{CVE Intel contributors}},
  year    = {2026},
  version = {0.3.0},
  url     = {https://github.com/Fazmin/cve-intel},
  license = {MIT},
  note    = {Native Rust desktop app, CLI, MCP server and REST API}
}

Use the version you ran (cve-intel --version).

CVE Intel only queries these services. It does not own or republish their data, and their terms apply to anything you copy out of the app. Check each provider's current terms, especially before commercial use. This is not legal advice.

Local AI models are not part of this project and carry their own licences, such as the Llama 3.2 Community License and size-dependent Qwen licences. Read the model's page before commercial use. GGUF files come from the Hugging Face repositories listed in crates/cve-core/src/llm.rs (the vendors' own for Qwen, bartowski's builds for Llama), and MLX builds from the mlx-community conversions. The runtimes are llama.cpp (MIT) and, on Apple silicon, mlx-lm (MIT).

• CONTRIBUTING.md: development setup and pull request guidelines
• CODE_OF_CONDUCT.md: community standards
• SECURITY.md: reporting a vulnerability privately

MIT. See LICENSE.