# Example Vuln MCP

> Demo data · fictional, for layout only.

> MCP server that looks up CVEs and ranks findings by exploitability for vulnerability prioritisation.

- Badge: `reach ≥1 · beyond declared (1)`
- Type: MCP server; tier: tried
- Tasks: Vulnerability prioritization; mission: Defensive; works with: Any MCP client, Claude Code
- Source: https://github.com/example/vuln-mcp, pinned to `7c1e9a0` (1.3.0), licence MIT
- Last checked: 2026-10-07; next check: 2027-04-05; method v0.1, reach-v0.1

## At a glance

- **What it is:** An MCP server that looks up CVE details and ranks a list of findings by exploitability. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Looks up CVE details for your findings. +1 more
- **Runs:** On your machine, started by your AI client.
- **Sends data to:** Vulnerability data service (always), stats.example.org (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** No changing, deleting or command-running capability among the groups read.
- **Needs:** An API token for the vulnerability data service, as a file or environment variable · Python 3.11 or later

Profile read at commit `7c1e9a0` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

An MCP server that looks up CVE details and ranks a list of findings by exploitability. (README.md#L3)

Made for (the author says):

- Looks up CVE details for your findings. (README.md#L6)
- Ranks a list of findings by exploitability. (README.md#L7)

Documented uses:

- Rank the findings of a scan export before a patch meeting [Vulnerability prioritization] (README.md#L20)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| lookup_cve | Fetches the details of one CVE from the vulnerability data service. (server.py#L40) | reads | yes |
| rank_findings | Sorts a list of findings by exploitability score. (server.py#L58) | reads | yes |

## How it runs

A Python MCP server that your MCP client starts over stdio; it calls the vulnerability data service with your token. (README.md#L30)

- Starts: On your machine, started by your AI client. Your MCP client starts it and talks to it over stdio. (server.py#L90)
- Your AI client: **MCP client configuration**: Starts the server and passes the token. (README.md#L34)
- Your machine: **vuln-mcp server**: Python process with the two tools. (server.py#L12)
- Sends data to Vulnerability data service (vendor API, always): CVE identifiers and your API token. (client.py#L22)
- Sends data to stats.example.org (telemetry, by default): Usage statistics; the README does not name this host. (telemetry.py#L8)

## What you need

- Credentials: An API token for the vulnerability data service, as a file or environment variable. (README.md#L16)
- Runtime: Python 3.11 or later. (pyproject.toml#L6)

## Limits and risks

- The server declares no rights: no MCP tool annotations, no network statement in the README. (server.json#L1)

## Rights in plain language

- Declared: nothing.
- Code: reach ≥1 (scoped): nothing above level 1; unknown: approval.
- Lab: Beyond declared on 1 of 6 rights: network (undeclared host api.example.net, blocked). Nothing is declared, so each right is measured against its task scope.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 1 (scoped), one right unknown.

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | not declared | 0 reads only files you give it | 0 reads only files you give it |
| Network: whom does it talk to? | not declared | 1 talks only to declared hosts | 2 talks to any host (beyond declared) |
| Execution: what does it run? | not declared | 0 runs no programs | 0 runs no programs |
| Secrets: which credentials does it touch? | not declared | 1 uses one scoped token | 1 uses one scoped token |
| Persistence: what survives the run? | not declared | 1 leaves cache or temp files | 1 leaves cache or temp files |
| Approval: does it ask before acting? | not declared | ? unknown | ? unknown |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L31` at the pinned commit (not a command to copy): `npx -y @example/vuln-mcp@1.3.0`

- demo, not installable

### Run it with least privilege

- claude code: `sandbox.network.strictAllowlist: [api.example.com]`
- docker: `allowHosts: [api.example.com]`

- tested in the lab run

## Maintainer's notes

**Demo entry.** Fictional maintainer remark: in the demo, I would turn the telemetry off before first use.

## Lab runs

### 2026-10-03

One run is an observation, not a benchmark.

- Run and written by Ilja Schlak, 2026-10-07
- Target: Lab CVE list (10 items) demo-1; model claude-sonnet-demo-20260901; claude-code mode dontAsk; white-box
- Verdict: Beyond declared on 1 of 6 rights: network (undeclared host api.example.net, blocked). Nothing is declared, so each right is measured against its task scope.
- Use again: with-limits; Useful ranking; the usage statistics to an undeclared host should be opt-in.
- Artifacts: https://readbeforerun.ai/catalog/example-vuln-mcp/runs/2026-10-03/

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Example Vuln MCP declare?**

nothing.

**What does its code suggest?**

reach ≥1 (scoped): nothing above level 1; unknown: approval.

**What did it use when it ran in the lab?**

Beyond declared on 1 of 6 rights: network (undeclared host api.example.net, blocked). Nothing is declared, so each right is measured against its task scope.

**Was it tried, and when?**

Yes: 2026-10-03.

**What changed since the last check?**

Upstream last pushed 2026-09-30; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Tested: claude_code: sandbox.network.strictAllowlist: [api.example.com]; docker: allowHosts: [api.example.com]

Method: https://readbeforerun.ai/method/