Ansvar: Threat Intelligence

ansvar-systems/ansvar-mcp-gateway

Connects Claude to Ansvar's EU-hosted threat intelligence gateway for security engineering workflows. Exposes CVE lookups, STRIDE threat modeling, and OWASP ASVS test case generation with article-level citations back to frameworks like ISO 27001 and NIS2. Every answer includes source URLs, confidence scores, and audit trails. Requires OAuth and a paid Ansvar account. Reach for this when you're running threat models or gap analyses and need control mappings that cite exactly where each mitigation comes from, not just generic security advice. The gateway fans requests across 262 security frameworks and can cross-reference your internal policies in the same citation contract.

tools: 8
last updated: Apr 21, 2026

View on GitHub

Tools

8 tools

Public tool metadata for what this MCP can expose to an agent.

lookup_cveGet full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.1 params

Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.

Parameters* required

cve_idstring

CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

assess_tech_riskAssess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.1 params

Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.

Parameters* required

technologiesstring

Comma-separated list of technology names (e.g., "Apache HTTP Server, OpenSSL, nginx"). Max 50 technologies.

search_cvesSearch for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.4 params

Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.

Parameters* required

has_exploitstring

Only show CVEs with public exploitsone of true · false

is_kevstring

Only show CVEs in CISA KEV catalogone of true · false

querystring

Search keyword (CVE ID, technology name, or description)

severitystring

Filter by severityone of CRITICAL · HIGH · MEDIUM · LOW

get_kev_recentGet recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.1 params

Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Parameters* required

daysstring

Number of days to look back (1-365, default: 30)

get_trending_cvesGet currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.1 params

Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.

Parameters* required

limitstring

Maximum results to return (1-100, default: 20)

get_weaponization_scoreGet the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.1 params

Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.

Parameters* required

cve_idstring

CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

lookup_ip_reputationLook up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Input must be a valid IPv4 address.1 params

Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Input must be a valid IPv4 address.

Parameters* required

ipstring

IPv4 address to look up (e.g., 1.2.3.4)

get_threat_statsGet statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

No parameter schema in public metadata yet.