FOR AI ASSISTANTS

Vexday MCP

Verified threat intelligence inside your AI assistant. Claude, ChatGPT and other MCP clients look up Vexday's CVEs, active exploitation, exploits, actors, incidents and IOCs, and cross them with the technologies you monitor. Read-only, on the MSSP plan.

See the plans →API docs

What the assistant can do

Public data (the same as the API)

get_cveFull detail of a CVE: CVSS, risk score, EPSS, CISA and VulnCheck KEV, exploits, actors, Brazilian government alerts and VEX.
get_cvesSeveral CVEs at once; each counts as one call.
search_cvesSearch by text, vendor, product, severity, CWE, KEV or public PoC.
search_exploitsPublic exploits and PoCs (links only), from GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB.
search_actorsThreat groups (APTs, ransomware and crime), with a filter for those with victims in Brazil.
get_actorGroup profile: aliases, origin, sectors, ATT&CK techniques, exploited CVEs and victims.
search_incidentsBreaches and incidents verified by the MORGUE method, published and TLP:CLEAR only.
get_incidentThe full CTI report of an incident: BLUF, confidence-rated judgments, timeline and sources.
search_iocsIndicators of compromise (URLs, domains, IPs, hashes) from abuse.ch, linked to malware families and actors.
search_victimsOrganizations listed on ransomware extortion sites: the criminals' claims, not confirmations.
get_vexWhat the vendor states about a CVE: affected, not affected, fixed or under investigation.

Your portfolio

list_my_stackThe technologies your account monitors in the alerts, with client tags.
check_cve_against_my_stackWhich of the account's technologies and clients a CVE affects, by the same matching the alerts use.
list_my_alertsThe alerts the account received in recent days, by client and level.

How to connect

Claude.ai and ChatGPT: connector, no key

  1. Copy the MCP address: https://api.vexday.io/mcp.
  2. In the connector settings of Claude.ai or ChatGPT, add a custom connector with that address.
  3. The assistant opens the Vexday screen. Sign in to your account, by email or Google, check the return address the screen shows and click Allow.
  4. Done. The connector shows up in your dashboard as the key “Conector: assistant name”, and its usage counts against the account limit. To disconnect, revoke that key.

Claude Code, Cursor, VS Code and others: API key

Clients that accept a header use the same API key, generated in the dashboard:

# Claude Code
claude mcp add --transport http vexday https://api.vexday.io/mcp \
  --header "Authorization: Bearer vx_live_sua_chave"

# Cursor, VS Code e outros (JSON de configuração do cliente)
{
  "mcpServers": {
    "vexday": {
      "url": "https://api.vexday.io/mcp",
      "headers": { "Authorization": "Bearer vx_live_sua_chave" }
    }
  }
}

Example questions

  • Does CVE-2024-3400 affect any of my clients? Is there a public exploit?
  • Which Fortinet CVEs are in the KEV, and which is the most dangerous?
  • Which ransomware groups listed victims in Brazil, and which CVEs do they exploit?
  • Summarize last week's alerts for client-acme.

Plan and limits

The MCP is part of the MSSP plan. Each tool call counts as one against the account limit, the same as the API's, and get_cves counts one per CVE.

MSSP: $99 (or R$499) per month · 20,000 calls per day

See the plans →

Rules

  • Read-only: no tool changes your account, your alerts or the data.
  • The same data as the API, TLP:CLEAR only, with the attribution field: each response's sources and licenses.
  • The three portfolio tools read only the connected account.
  • The assistant summarizes what the tools return: check the source before acting.

All sources and licenses