CVE Intel

CVE Intel is a local-first vulnerability triage and scanning tool written in native Rust, published by Fazmin on GitHub. Given a CVE ID, project folder, lockfile, SBOM, container image, the software on the current computer, owned domains, or a suspicious IP, hash or domain, it queries public intelligence sources and returns a 0 to 100 risk score, the evidence behind it and a recommended action. The same executable runs as a desktop app, a command line, a REST server and an MCP server.

What It Is

CVE Intel is a vulnerability intelligence and prioritisation tool for security analysts, IT and operations teams, and developers checking dependencies. It replaces manual checking of NVD, CISA, FIRST, GitHub and vendor advisories by combining them into one lookup. The README states there is no CVE Intel account or server: lookups go from the user's computer directly to public sources. It helps decide what to patch but does not probe, port-scan, attack or apply fixes.

How the triage workflow works

CVE Triage combines NVD, CVE.org, EPSS, CISA KEV, ENISA EUVD and public exploit sources into a risk score built from CVSS, EPSS, KEV status and public exploit evidence. A CVE listed in CISA KEV is always rated critical. Deep triage adds a CISA SSVC decision, a side-by-side view of where sources disagree, and an exploit-speed estimate. Compare CVEs orders 2 to 10 CVEs into a patch order. A Landscape view summarises weekly changes, and a local watchlist records new KEV listings, EPSS jumps, exploits and fixes.

Scanning and SBOMs

Dependency scans read lockfiles, manifests and CycloneDX or SPDX SBOMs, check packages against OSV.dev, and rank findings by real-world risk with the fixing version. Scans can also cover the installed software on the computer, container images without Docker, and a passive public exposure check of domains the user owns. Attack chain analysis links findings, and scans can be saved as CycloneDX 1.5 SBOMs with findings and recorded decisions. Decisions can be recorded with assumptions and flagged stale when evidence changes, and exported as OpenVEX or CycloneDX VEX. In CI, scans can fail a build or output SARIF for GitHub code scanning.

Local AI and agent access

Ask AI looks up facts first, then explains them with a local llama.cpp model, or optionally with OpenAI, Anthropic, Gemini or an OpenAI-compatible endpoint. The MCP server exposes 41 tools to clients such as Claude Code, Cursor, VS Code, Claude Desktop and Windsurf, over HTTP or stdio, bound to loopback.