MCP API - MidnightBSD Security Advisories

MCP Server

A native Model Context Protocol server that lets AI coding agents look up CVEs, resolve CPE identifiers, and check whether the packages installed on an operating system are affected by known vulnerabilities. It speaks the MCP Streamable HTTP transport, so any MCP client can connect to a single URL — no wrappers or fetch shims required.

Endpoint Tools Add it to your agent Claude Codex Other clients Verify

Endpoint

Connect your MCP client to the single endpoint below using the Streamable HTTP transport (sometimes shown as HTTP or streamable-http):

https://sec.midnightbsd.org/api/mcp

Transport: Streamable HTTP (MCP spec 2025-03-26 and later).
Auth: none — the server is public and read-only.
Server name: security-advisory.

Your client discovers the tools automatically over the protocol (an MCP tools/list call); there is no separate manifest URL to configure.

Tools

The server advertises these tools. Optional parameters are marked (opt).

Tool	Parameters	Description
`get_cve`	`cveId`	Full detail for a single CVE (e.g. `CVE-2024-3094`); null if not tracked.
`search_advisories`	`term`, `page` (opt), `size` (opt)	Free-text search over CVE id and description; returns one page of matches.
`match_cpe`	`cpe`, `includeVersion` (opt)	Match advisories from a full or partial CPE 2.3 identifier.
`product_advisories`	`name`	All advisory summaries that reference a product name.
`check_package`	`name`, `version` (opt), `vendor` (opt)	Version-aware verdict on whether one installed package is vulnerable.
`check_packages`	`packages` — list of `{name, version?, vendor?}`	Batch-check a list of installed packages for known vulnerabilities.

Add it to your agent

Every example below registers the same Streamable HTTP endpoint under the name security-advisory. Once connected, ask your agent things that map directly onto the tools above:

“Use security-advisory to pull the details for CVE-2024-3094.” → get_cve
“Is sendmail 5.58 vulnerable according to security-advisory?” → check_package
“Search security-advisory for advisories mentioning openssl.” → search_advisories
“Match cpe:2.3:a:apache:mod_dav_svn:1.14.2 against security-advisory.” → match_cpe
“Here is the output of mport list -v — check every installed package for CVEs.” → check_packages

Claude Code native

Use the built-in HTTP transport — no fetch server needed:

claude mcp add --transport http security-advisory https://sec.midnightbsd.org/api/mcp

# verify it connected
claude mcp list

# then, in a Claude Code session:
#   "Using security-advisory, check whether sendmail 5.58 is vulnerable,
#    and pull the full details for any CVE it reports."

Or commit it to your repo as .mcp.json so teammates share it:

{
  "mcpServers": {
    "security-advisory": {
      "type": "http",
      "url": "https://sec.midnightbsd.org/api/mcp"
    }
  }
}

Codex native

Codex supports streamable HTTP servers directly via --url:

codex mcp add security-advisory --url https://sec.midnightbsd.org/api/mcp

# list configured servers
codex mcp list

# then prompt Codex, e.g.:
#   "With security-advisory, match cpe:2.3:a:apache:mod_dav_svn:1.14.2
#    (include the version) and summarize the advisories."

The equivalent entry in ~/.codex/config.toml:

[mcp_servers.security-advisory]
url = "https://sec.midnightbsd.org/api/mcp"

Other clients (Antigravity, Claude Desktop, …)

Most MCP clients accept the standard mcpServers JSON shape. For an HTTP/streamable server, give it a url (and type: "http" where the client asks for a transport):

{
  "mcpServers": {
    "security-advisory": {
      "type": "http",
      "url": "https://sec.midnightbsd.org/api/mcp"
    }
  }
}

Verify the connection

You can exercise the endpoint by hand with curl. A real client negotiates a session first; this tools/list call confirms the server is up and lists the tools:

# List the security-advisory tools
curl -sN https://sec.midnightbsd.org/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

# Call a tool directly: is sendmail 5.58 vulnerable?
curl -sN https://sec.midnightbsd.org/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"check_package",
                 "arguments":{"name":"sendmail","version":"5.58"}}}'

Note: this is a real MCP server, not a plain REST API — POST JSON-RPC to /api/mcp rather than issuing GET requests to per-tool paths. Let your MCP client drive it; the curl above is only for a quick smoke test.