What tools does the patch-tuesday MCP server provide?

patch-tuesday exposes 1 tools: msrc_search. This list was returned by the running server when we connected to it.

Does patch-tuesday require an API key?

No. patch-tuesday answered a tools/list request without credentials.

Connection check verified live · 27h ago

patch-tuesday

Query Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment

Security Web search & scraping Databases & SQL

Install

Remote (HTTP)

claude mcp add --transport http patch-tuesday https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp

Tools 1

GitHub stars 4

Installs / wk —

Licence —

Transport streamable-http, stdio

Last checked 27h ago

Tools & capabilities

1 tool

Read from the running server on 27h ago.

msrc_search read-only kbcvecwekevlimitmonth +34

Search Microsoft security updates (Patch Tuesday) from the official MSRC API. Combines keyword search, CVE/KB lookup, and product/severity/exploitation filtering into a single fle… Search Microsoft security updates (Patch Tuesday) from the official MSRC API. Combines keyword search, CVE/KB lookup, and product/severity/exploitation filtering into a single flexible tool. All filter parameters are optional and can be combined. When no filters are provided, returns the most urgent vulnerabilities from the most recent *released* Patch Tuesday (CISA-KEV- listed or exploited first, then by EPSS exploitation probability, severity, and CVSS score). The upcoming month's document exists before its Patch Tuesday but only holds early Chromium/third-party and out-of-band entries; it is skipped by default and served only when requested via month=. Results are enriched with EPSS scores (FIRST.org daily exploit prediction, 0-1) and CISA KEV (Known Exploited Vulnerabilities) catalog data when available. Use this tool to: - Get the latest Patch Tuesday overview (include_stats=True, limit=0) - Browse the most urgent fixes this month (no filters) - Look up a specific CVE with full detail (cve="CVE-2026-41108") -- works across all months, returns KBs, affected products, CVSS, description, FAQs, EPSS score, and KEV status - Find which CVEs a KB article fixes (kb="5094123" or kb="KB5094123") -- scans recent months, or a specific month when combined with month= - Look up many KBs in one call (kb=["5094123", "KB5094127", ...], up to 30) -- e.g. a machine's installed-update list; returns one grouped per-KB result entry each, with per-KB found/not-found status - Check whether a KB has been superseded by newer patches (kb="5087538", include_chain=True) -- walks Microsoft-stated supersedence links - See what Microsoft has confirmed an update breaks (kb=..., include_known_issues=True) -- known issues from the KB's public support page: symptoms, workarounds, and the resolving update when stated - See what an update changes (kb=..., include_update_summary=True) -- the KB support page's summary and improvements highlights, beyond the security fixes already listed in the MSRC data - Find KEV-listed CVEs this month (kev=True) -- confirmed exploited, with federal remediation due dates - High exploitation probability (min_epss=0.5) -- EPSS >= 50% - Search by keyword (query="Exchange" or query="DNS spoofing") - Filter to a product (product="Windows Server 2022") -- partial match - Filter to a product watchlist (product_profile="identity-core", or products=["Exchange Server", "Windows Server"] / product_families=["Windows", "Azure"]) -- keeps vulns matching any listed product or family; matching is local and profiles never leave the host - Filter by severity (severity="Critical") -- Critical/Important/Moderate/Low - Find actively exploited vulnerabilities (exploited=True) - Find publicly disclosed zero-days (publicly_disclosed=True) - Filter by CVSS score (min_cvss=8.0) - Look at a past month (month="2026-Apr" or month="2026-04") - Combine filters (product="Exchange" + severity="Critical" + month="2026-05") - Search a historical range (query="HTTP.sys" + months_back=6, or start_month="2026-Jan" + end_month="2026-Jun") -- aggregates matching CVEs across released months with per-month trend counts - Paginate with offset (offset=10, limit=10 for page 2) Args: query: Optional keyword; case-insensitive match across CVE ID, title, description, component tag, and affected product names. cve: Optional CVE ID (e.g. "CVE-2026-41108"). Fast path: ignores other filters and returns full detail for that single CVE, searching across all months automatically. kb: Optional KB article number (e.g. "5094123" or "KB5094123") or a list of up to 30 of them for a batched lookup. Fast path: returns the CVEs fixed by that KB, scanning the most recent months (up to 6), or only the given month when month= is also set. A list input returns a grouped response instead: a results array with one entry per KB ("kb", "found", and on success the same body as a single-KB lookup; on a miss "error"/"error_kind"), deduplicated, order preserved. limit/offset apply per KB; other filters are ignored. Accepts numeric KB ids only (any malformed list entry fails the whole call); kb_articles in results may also contain non-KB vendor-fix labels such as "Release Notes", which cannot be looked up here. month: Optional monthly release to search, formatted "2026-Apr" or "2026-04". Defaults to the most recent release whose Patch Tuesday (second Tuesday of the month) has already occurred; pass the upcoming month explicitly to see its pre-release entries. Combined with kb=, restricts the KB lookup to that month. product: Optional product name filter (case-insensitive partial match against affected product names, e.g. "Windows Server 2022"). product_profile: Optional named watchlist (e.g. "identity-core") that expands locally into product/family matchers. Built-in profiles can be overridden/extended via a JSON file at MSRC_PROFILES_PATH. An unknown name returns an invalid_input error listing the available profiles. Profile contents are matched locally and never sent to MSRC, FIRST.org, CISA, or telemetry. products: Optional list of product-name partial matchers. A vulnerability is kept if any entry matches one of its affected products. product_families: Optional list of product-family partial matchers. A vulnerability is kept if any entry matches one of its product families. Combined with products/product_profile as a union (match any listed product OR family). severity: Optional maximum-severity filter. Valid values: Critical, Important, Moderate, Low. exploited: Optional filter for vulnerabilities known to be exploited in the wild (True) or not (False), per Microsoft's assessment. publicly_disclosed: Optional filter for publicly disclosed vulnerabilities. kev: Optional filter for CVEs on (True) or off (False) the CISA Known Exploited Vulnerabilities catalog. ransomware: Optional filter for CVEs whose CISA KEV entry reports known ransomware campaign use (True) or not / not on KEV (False). exploitation_likely: Optional filter on Microsoft's latest-release exploitation assessment: True matches "Exploitation More Likely" or "Exploitation Detected"; False matches everything else (including unassessed entries). Matching results include an exploitation_assessment field. cwe: Optional weakness filter; case-insensitive substring match against CWE entries (e.g. "CWE-416" or "use after free"). Matching results include their cwe list. min_epss: Optional minimum EPSS score (0-1), the probability of exploitation in the next 30 days (e.g. 0.5 for >= 50%). min_cvss: Optional minimum CVSS base score (0-10). attack_vector: Optional CVSS attack-vector filter, one of N (network), A (adjacent), L (local), P (physical). Matches the parsed CVSS v3.x vector; entries without a parseable vector are excluded. privileges_required: Optional CVSS privileges-required filter, one of N (none), L (low), H (high). user_interaction: Optional CVSS user-interaction filter, one of N (none), R (required). scope: Optional CVSS scope filter, one of U (unchanged), C (changed). include_chain: When True together with kb=, adds a supersedence_chain showing which KBs this KB replaces (newest to oldest), walked from Microsoft-stated supersedence links. Ignored without kb=. include_guidance: When True together with cve=, adds a guidance list to the CVE detail output with any Microsoft-provided mitigations, workarounds, and will-not-fix advisories (type/description/url). Omitted by default to keep responses lean. Ignored without cve=. include_references

Context cost

Light

Connecting this server adds 1 tool definitions to every request — roughly 90 tokens before you ask anything.

Adds little to your context. Safe to keep connected.

Estimated at ~90 tokens per tool. Actual size varies with schema complexity — treat this as an order of magnitude, not a measurement.

Similar servers

nist-nvd-mcp-server local install

both mention “cisa”

endoflife-mcp verified live · 27h ago

both mention “cisa” · 10 tools

eurorack verified live · 20h ago

both mention “patch” · 17 tools

bannerlordsage local install

both mention “patch”

diff-patch-tools verified live · 27h ago

both mention “patch” · 6 tools

drupal-code-query verified live · 26h ago

both mention “patch” · 16 tools

Ranked by shared tools where both expose an inventory, otherwise by shared wording.

Source & links

Repository: jonnybottles/patch-tuesday-mcp
Registry: io.github.jonnybottles/patch-tuesday
Endpoint: https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp
Sources: registry + github