Cisa Cybersecurity MCP Server

Cisa Cybersecurity MCP Server is a remote MCP server: there is nothing to install. Its endpoint is https://cisa-cybersecurity.caseyjhand.com/mcp, served over Streamable HTTP. In an assistant that accepts remote MCP servers (often under a setting named connectors, integrations or tools), add a new server and give it this URL; in a client configured by file, add it as a remote (HTTP) server with the same URL.

No headers are declared in the registry entry. If the server needs you to sign in, a client that supports MCP authorization opens the service's own sign-in page when it first connects.

It can also run locally from a Node.js package published to the npm registry: @cyanheads/cisa-cybersecurity-mcp-server version 0.3.0. It speaks MCP over stdio, so the client starts it as a program and talks to it through standard input and output. It needs Node.js; clients usually start it with npx — the usual command is npx -y @cyanheads/cisa-cybersecurity-mcp-server@0.3.0; the entry names node as the runtime. It reads these environment variables: MCP_LOG_LEVEL, CISA_KEV_REFRESH_CRON, CISA_CSAF_MIRROR_PATH, CISA_CSAF_MIRROR_AUTO_INIT, CISA_CSAF_REFRESH_CRON, CISA_VULNRICHMENT_CACHE_TTL_SECONDS, CISA_FEED_CACHE_TTL_SECONDS and CISA_HTTP_TIMEOUT_MS; set them in the client's configuration for this server.

It can also run locally from a Node.js package published to the npm registry: @cyanheads/cisa-cybersecurity-mcp-server version 0.3.0. The package starts a local server that speaks MCP over Streamable HTTP; the client then connects to it by URL (the entry names node as the runtime). It reads these environment variables: MCP_HTTP_HOST, MCP_HTTP_PORT, MCP_HTTP_ENDPOINT_PATH, MCP_AUTH_MODE, MCP_LOG_LEVEL, CISA_KEV_REFRESH_CRON, CISA_CSAF_MIRROR_PATH, CISA_CSAF_MIRROR_AUTO_INIT, CISA_CSAF_REFRESH_CRON, CISA_VULNRICHMENT_CACHE_TTL_SECONDS, CISA_FEED_CACHE_TTL_SECONDS and CISA_HTTP_TIMEOUT_MS; set them in the client's configuration for this server.

In the mcpServers JSON format that many desktop and editor MCP clients read, the entry looks like this (placeholders in angle brackets):

{
  "mcpServers": {
    "cisa-cybersecurity-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/cisa-cybersecurity-mcp-server@0.3.0"
      ],
      "env": {
        "MCP_LOG_LEVEL": "<value>",
        "CISA_KEV_REFRESH_CRON": "<value>",
        "CISA_CSAF_MIRROR_PATH": "<value>",
        "CISA_CSAF_MIRROR_AUTO_INIT": "<value>",
        "CISA_CSAF_REFRESH_CRON": "<value>",
        "CISA_VULNRICHMENT_CACHE_TTL_SECONDS": "<value>",
        "CISA_FEED_CACHE_TTL_SECONDS": "<value>",
        "CISA_HTTP_TIMEOUT_MS": "<value>"
      }
    }
  }
}

Derived from the registry entry, not tested here. What the server does, and on what terms, is set by its publisher; check its repository or website before giving it access to your accounts or files. How to add an MCP server to an assistant · Before you connect