MCP Server
KernelScan
io.kernelscan/kernelscan
What this MCP does
Analyzes Linux kernel configurations for affecting CVEs and provides CycloneDX VEX vulnerability reports and paginated vulnerability details.
Capabilities
Tools
11
tools
create_product
Create a new product, run analysis, and return its initial stats.
``config_upload_id`` references a previously-staged .config that the
caller POSTed to ``/api/configs/uploads`` over plain HTTP â the LLM
does NOT emit the config text itself (a real kernel .config is
~100â200 KB and exceeds a single tool-call output budget). Workflow:
1. Caller / wrapper script:
``curl -H "Authorization: Bearer ks_live_..." \
-F "config_file=@.config" \
https://kernelscan.io/api/configs/uploads``
returns ``{config_upload_id, sha256, size_bytes, expires_at}``.
2. Pass that ``config_upload_id`` into this tool.
Uploads are per-user, single-use, and expire 30 minutes after upload.
Same gates as POST /api/products: free can't create products; paid
plans are capped at their resolved product limit â read it (and any
per-account override) from ``whoami.product_limit`` rather than assuming
a fixed per-tier number. ``factor_ids`` are silently ignored unless the
plan allows security factors (``whoami.can_use_factors``). Re-using a
product name returns 409.
Creating a product RUNS an analysis, so it spends one unit of the
team's SHARED monthly analysis allowance (``whoami.monthly_analyses_used``
/ ``monthly_analyses_limit``). When the allowance is exhausted the tool
fails with "Monthly analysis limit reached (â¦/month) [429]". This is a
durable monthly quota â NOT the transient per-call rate limit that also
surfaces as 429: it will not clear until next month, so report it to the
user instead of retrying. Check ``whoami`` before a batch of creates.
Input schema
{'type': 'object', 'title': 'create_productArguments', 'required': ['name', 'kernel_version', 'arch', 'config_upload_id'], 'properties': {'arch': {'type': 'string', 'title': 'Arch'}, 'name': {'type': 'string', 'title': 'Name'}, 'factor_ids': {'anyOf': [{'type': 'array', 'items': {'type': 'string'}}, {'type': 'null'}], 'title': 'Factor Ids', 'default': None}, 'description': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Description', 'default': None}, 'kernel_version': {'type': 'string', 'title': 'Kernel Version'}, 'config_upload_id': {'type': 'string', 'title': 'Config Upload Id'}}}
get_cve
Fetch a single Linux kernel CVE by ID (e.g. ``CVE-2024-12345``).
No API key required: keyless callers get the public representation of a
CVE, but only for CVEs in the public set (recent high-severity); any
other id returns ``not found``. Free *keyed* callers get a 404 for CVEs
published more than 60 days ago. AI risk-summary / analysis fields are
included for any keyed user on CVEs in the public set, and for pro /
enterprise on every assessed CVE.
Input schema
{'type': 'object', 'title': 'get_cveArguments', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'title': 'Cve Id'}}}
get_product
Fetch one product owned by the caller, including the CVE breakdown.
Returns 404 (not 403) if the product belongs to another user, so
product existence isn't leaked across accounts.
Input schema
{'type': 'object', 'title': 'get_productArguments', 'required': ['product_id'], 'properties': {'product_id': {'type': 'string', 'title': 'Product Id'}}}
get_product_vex
Return the VEX MANIFEST for one of the caller's products â metadata,
not the document.
Multi-megabyte CycloneDX documents (up to 8,000+ vulnerability entries)
are not safe model-context payloads, so this tool returns a bounded
manifest: CycloneDX format/spec version, product id, generated/expires
timestamps, the VEX hash and the composite ETag identity, the
uncompressed size in bytes, total + per-status vulnerability counts,
and the authenticated REST download path. Reads from the 24h
ProductVexCache; if the cache is empty/expired the next call to
``get_product`` (or the REST endpoint) will regenerate it.
The MANIFEST carries the same ``kernelscan.io:exploit_maturity`` /
``kernelscan.io:kev`` overlay identity as the REST download
(backend#337), so ETags compare across transports.
To inspect the entries themselves, use ``list_product_vex_entries``.
To retrieve the COMPLETE CycloneDX document, use the authenticated
REST endpoint ``GET /api/products/{product_id}/vex`` (same ks_live_
key) â that is the canonical way to retrieve the full artifact; no
MCP tool returns it.
Input schema
{'type': 'object', 'title': 'get_product_vexArguments', 'required': ['product_id'], 'properties': {'product_id': {'type': 'string', 'title': 'Product Id'}}}
list_products
List the calling user's products with denormalized analysis stats.
Paid plans only (basic / pro / enterprise). Free callers get a clear
upgrade message.
Input schema
{'type': 'object', 'title': 'list_productsArguments', 'properties': {}}
Output schema
{'type': 'object', 'title': 'list_productsOutput', 'required': ['result'], 'properties': {'result': {'type': 'array', 'items': {'type': 'object', 'additionalProperties': True}, 'title': 'Result'}}}
list_product_vex_entries
Page through the VEX vulnerability entries of one of the caller's products.
Returns COMPLETE CycloneDX vulnerability objects for one bounded page
â never the root document, never all entries â plus ``returned``,
``total_matching``, and a ``next_cursor`` to continue with. Every
result is bounded to 256 KiB: the page stops before the byte limit and
returns a cursor when necessary. Entries are ordered by CVE id
(ascending) and carry the same live ``kernelscan.io:exploit_maturity``
/ ``kernelscan.io:kev`` properties as the REST download (backend#337).
Filters (all optional, combinable):
- ``statuses``: ``affected`` / ``not_affected`` / ``in_triage``
- ``severities``: ``critical`` / ``high`` / ``medium`` / ``low`` / ``none``
- ``kev``: true/false â CISA KEV listing only / non-KEV only
- ``exploit_maturity``: ``poc`` / ``weaponized``
- ``cve_ids``: exact-match list of CVE ids
``limit`` defaults to 25, maximum 100. ``cursor`` is the opaque
continuation token from a previous page â it is tied to the product,
the active filters, AND the current document + threat-overlay
revision: changing filters, a regenerated cache, or a KEV/PoC signal
that moved since the last page invalidates it (start a fresh page
without a cursor â re-using a stale one is rejected, never silently
re-applied). Within one revision, concatenating all pages yields
each matching CVE exactly once.
The COMPLETE multi-megabyte CycloneDX document is served by the
authenticated REST endpoint ``GET /api/products/{product_id}/vex``
(same ks_live_ key) â the canonical way to retrieve the full artifact.
Input schema
{'type': 'object', 'title': 'list_product_vex_entriesArguments', 'required': ['product_id'], 'properties': {'kev': {'anyOf': [{'type': 'boolean'}, {'type': 'null'}], 'title': 'Kev', 'default': None}, 'limit': {'type': 'integer', 'title': 'Limit', 'default': 25}, 'cursor': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Cursor', 'default': None}, 'cve_ids': {'anyOf': [{'type': 'array', 'items': {'type': 'string'}}, {'type': 'null'}], 'title': 'Cve Ids', 'default': None}, 'statuses': {'anyOf': [{'type': 'array', 'items': {'type': 'string'}}, {'type': 'null'}], 'title': 'Statuses', 'default': None}, 'product_id': {'type': 'string', 'title': 'Product Id'}, 'severities': {'anyOf': [{'type': 'array', 'items': {'type': 'string'}}, {'type': 'null'}], 'title': 'Severities', 'default': None}, 'exploit_maturity': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Exploit Maturity', 'default': None}}}
request_access
Explain how to get a KernelScan account (no API key needed).
Self-registration is open â there is no invitation to wait for and no
admin in the loop. The user signs up on kernelscan.io themselves (email
+ password, accepting the terms), confirms the verification mail, and
mints a ks_live_ API key on their account page.
This tool only hands that path back: it files nothing and sends no
mail. ``email`` / ``name`` / ``reason`` are still accepted so older
clients don't break, but they are ignored â never tell the user that a
request was submitted on their behalf.
Input schema
{'type': 'object', 'title': 'request_accessArguments', 'properties': {'name': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Name', 'default': None}, 'email': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Email', 'default': None}, 'reason': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Reason', 'default': None}}}
search_cves
Search Linux kernel CVEs.
No API key required: keyless callers get the free public tier â recent
high-severity Linux kernel CVEs (capped at 25 results). Free *keyed*
callers see only CVEs published in the last 60 days; basic+ keyed
callers get the full corpus.
``query`` matches against CVE id and description (case-insensitive).
``severity`` filters by effective severity (``critical``/``high``/``medium``/``low``).
``cvss_min`` filters by effective CVSS score.
``published_after`` (ISO 8601) returns only CVEs newer than that date.
Returns up to ``limit`` (max 100) CVEs, newest first.
Input schema
{'type': 'object', 'title': 'search_cvesArguments', 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 25}, 'query': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Query', 'default': None}, 'cvss_min': {'anyOf': [{'type': 'number'}, {'type': 'null'}], 'title': 'Cvss Min', 'default': None}, 'severity': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Severity', 'default': None}, 'published_after': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Published After', 'default': None}}}
submit_support_report
Send a support / dispute report to KernelScan staff.
Use this when an automated CVE or factor assessment looks wrong, or
when you need to hand human-needed context back to the team. The
caller's API-key user is attached automatically (id, email, plan)
so support can look the account up.
``category`` should be one of:
- ``cve_assessment`` â wrong AI verdict / CVSS / CWE on a CVE
- ``factor_assessment`` â wrong factor verdict for a product
- ``bug`` â broken behavior in the API or UI
- ``other`` â anything else
``cve_id`` / ``product_id`` / ``assessment_id`` are optional but
recommended â they let support jump straight to the relevant row.
Input schema
{'type': 'object', 'title': 'submit_support_reportArguments', 'required': ['category', 'subject', 'message'], 'properties': {'cve_id': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Cve Id', 'default': None}, 'message': {'type': 'string', 'title': 'Message'}, 'subject': {'type': 'string', 'title': 'Subject'}, 'category': {'type': 'string', 'title': 'Category'}, 'product_id': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Product Id', 'default': None}, 'assessment_id': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Assessment Id', 'default': None}}}
update_product
Update a product owned by the caller. Re-runs analysis if the
kernel_version, arch, or referenced .config changed.
To change the .config, first POST the new file to
``/api/configs/uploads`` (see ``create_product`` for the curl recipe)
and pass the returned ``config_upload_id`` here. Leave
``config_upload_id`` as ``None`` to keep the existing .config.
``factor_ids=None`` leaves factor selections untouched; an empty
list clears them. Same tier gates as PUT /api/products/{id}.
A change that re-runs analysis (``kernel_version``, ``arch``, or the
``.config``) spends one unit of the team's shared monthly analysis
allowance and can fail with the same durable "Monthly analysis limit
reached ⦠[429]" quota error as ``create_product`` (distinct from the
transient rate-limit 429 â don't retry it). A rename / description /
factor-only edit runs no analysis and is free.
Input schema
{'type': 'object', 'title': 'update_productArguments', 'required': ['product_id'], 'properties': {'arch': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Arch', 'default': None}, 'name': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Name', 'default': None}, 'factor_ids': {'anyOf': [{'type': 'array', 'items': {'type': 'string'}}, {'type': 'null'}], 'title': 'Factor Ids', 'default': None}, 'product_id': {'type': 'string', 'title': 'Product Id'}, 'description': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Description', 'default': None}, 'kernel_version': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Kernel Version', 'default': None}, 'config_upload_id': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Config Upload Id', 'default': None}}}
whoami
Return the caller's identity, plan, and quota state.
Works without an API key: keyless callers get a lightweight public-tier
payload (no account) describing how to request access.
Input schema
{'type': 'object', 'title': 'whoamiArguments', 'properties': {}}
History
Recent tool changes
Changed
request_access
Sept. 19, 2026, 2:48 a.m.
Added
submit_support_report
Sept. 17, 2026, 12:53 p.m.
Added
request_access
Sept. 17, 2026, 12:53 p.m.
Added
whoami
Sept. 17, 2026, 12:53 p.m.
Added
update_product
Sept. 17, 2026, 12:53 p.m.
Added
create_product
Sept. 17, 2026, 12:53 p.m.
Added
list_product_vex_entries
Sept. 17, 2026, 12:53 p.m.
Added
get_product_vex
Sept. 17, 2026, 12:53 p.m.
Added
get_product
Sept. 17, 2026, 12:53 p.m.
Added
list_products
Sept. 17, 2026, 12:53 p.m.
Added
get_cve
Sept. 17, 2026, 12:53 p.m.
Added
search_cves
Sept. 17, 2026, 12:53 p.m.
Discover
Similar MCP servers
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox
Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…
validoria-mcp
com.validoria/validoria-mcp
Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…
HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data
io.github.Its-fortunatefolly/hubvibe
Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…
developer-tools
net.programmes/developer-tools
Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…
Qiniso
io.github.qinisolabs/qiniso
Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…
ContrastAPI
com.contrastcyber/api
Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domain…