Excession Labs CVE Intelligence MCP

Why it got a C

Excession Labs' own hosted CVE endpoint at https://excessionlabs.ai/mcp/cve, over HTTPS with Streamable HTTP and no account or key. Six read-only tools (all marked readOnlyHint) search CVEs by text, vendor, product, package or source version, read one record with its source references, CISA KEV and FIRST EPSS data and paged affected-software assertions, show revision history, report collection freshness and coverage gaps, list data sources and return new or changed records after a cursor. The baseline is the CVE Program list, with NVD, CISA KEV, EPSS and GitHub Security Advisories layered on top. A literal version match is source evidence, not proof your system is affected. Excession says it doesn't inspect your devices or take a software inventory, and asks you not to put credentials or customer data in queries. Don't confuse it with Excession's main endpoint, https://excessionlabs.ai/mcp: it has the same CVE tools plus site search, contact details and request_security_test, which sends a penetration-test request to Excession Labs (a company that sells pen testing) and needs an agent key and the person's consent. This listing covers the CVE endpoint only. No advisories on record. Biggest deduction: there is no login at all, so nothing to scope or revoke, and the server is closed source (the public repo holds docs and tool definitions, created 2026-11-09, one account, no releases), so maintenance is scored one band lower and the request limits (HTTP 429) can't be checked in code.