Patch Tuesday MCP Server

mcp-name: io.github.jonnybottles/patch-tuesday

Ask your AI assistant about Microsoft security updates. This Python-based MCP (Model Context Protocol) server connects AI assistants like Claude, Copilot, and ChatGPT to the MSRC Security Update Guide — the authoritative source for every CVE Microsoft patches — enabling natural-language queries over Patch Tuesday releases: CVEs, KB articles, severity ratings, CVSS scores, affected products, and exploited-in-the-wild status.

What It Does

Patch Tuesday MCP Server bridges Microsoft's official CVRF security update API and your AI assistant, allowing you to:

- Get the monthly rollup - "What did this month's Patch Tuesday fix?"
- Find what's actively exploited - "Which vulnerabilities are being exploited in the wild?"
- Look up any CVE - "Tell me about CVE-2026-41108" (KBs, affected products, CVSS, description)
- Map KBs to CVEs - "Which vulnerabilities does KB5094123 fix?"
- Filter by product - "What Critical CVEs affect Windows Server 2022 this month?"
- Track zero-days - "Were any publicly disclosed vulnerabilities patched in April?"
- See what's confirmed exploited - "Which of this month's CVEs are on the CISA KEV list?" — with federal remediation due dates
- Rank by exploitation probability - "Show me CVEs with EPSS above 50%" — daily FIRST.org exploit prediction scores
- Find zero-click, internet-reachable criticals - "Which Critical CVEs are network-reachable with no privileges and no user interaction?" — filter on the parsed CVSS attack vector, privileges, and user-interaction fields
- Jump straight to authoritative sources - every CVE detail carries ready-to-open MSRC, NVD, EPSS, and (when listed) CISA KEV reference links
- Avoid stale patches - "Is KB5087538 superseded by anything newer?" — walks Microsoft's supersedence links
- Get mitigations when there's no patch yet - "Are there mitigations or workarounds for CVE-2026-47291?" — surfaces Microsoft's mitigation, workaround, and will-not-fix guidance
- Spot trends over time - "How many HTTP.sys CVEs shipped over the last 6 months?" (months_back=6, or start_month/end_month) — aggregates matches across released months with per-month counts
- Filter by Microsoft's own exploitation forecast - "Which of this month's CVEs does Microsoft rate 'Exploitation More Likely'?" (exploitation_likely=True)
- Spot ransomware-weaponized CVEs - "Which CVEs this month are used in known ransomware campaigns?" (ransomware=True; add include_kev_details=True for the full CISA entry with required actions)
- Plan the deployment, not just the priority - "Does KB5094123 require a restart, and what build fixes it?" (include_kb_details=True adds per-KB URLs, fixed builds, supersedence, and restart requirements)
- Slice a month by weakness class - "Show me this month's use-after-free CVEs" (cwe="CWE-416" or cwe="use after free")
- Discover the release catalog - "Which monthly releases are available, and when were they last revised?" (list_months=True)
- Export a triage briefing - "Give me this month's Critical CVEs as a Markdown report" or "…as CSV" — a prioritized executive summary and table, or a spreadsheet-ready export (format="markdown" / format="csv")
- Force-refresh & check data freshness - "Re-pull this month's data fresh" (force_refresh=True) bypasses the in-process caches; include_freshness=True reports the cache age/TTL of the MSRC document and EPSS/KEV enrichment
- Prioritize patching - Results are sorted most-urgent-first: KEV/exploited, then EPSS, then severity, then CVSS

Perfect for security analysts, sysadmins, and IT professionals who triage Microsoft security updates every month — without clicking through the Security Update Guide portal.

Data comes from the official, public MSRC CVRF v3 API. No authentication or API key required.

Why This Server?

This is the only MCP server that models the Patch Tuesday release itself. Plenty of MCP servers can look up a CVE — general-purpose vulnerability aggregators fan a known CVE ID out across NVD, OSV, and threat-intel feeds. They answer "tell me about CVE-X". But they have no concept of a monthly Microsoft release, a KB article, or a product family — so they structurally cannot answer the questions a Microsoft shop actually asks on the second Tuesday of every month:

| The question you actually have | Generic CVE lookup servers | patch-tuesday-mcp |
|---|---|---|
| "Summarize this month's Patch Tuesday" | ❌ no concept of a release | ✅ rollup + stats in one call |
| "What Critical CVEs affect Windows Server 2022 this month?" | ❌ can't filter by Microsoft product | ✅ product & family filtering |
| "Which vulnerabilities does KB5094123 fix?" | ❌ no KB awareness | ✅ KB ↔ CVE mapping |
| "What's being exploited in the wild right now?" | ⚠️ per-CVE only, if you already know the CVE | ✅ filter the whole month |
| "What do I patch first?" | ❌ | ✅ urgency-sorted: exploited/KEV → EPSS → severity → CVSS |
| "Which criticals are zero-click and internet-reachable?" | ⚠️ per-CVE CVSS only | ✅ filter the month by parsed CVSS attack vector / privileges / user interaction |
| "Tell me about CVE-X" | ✅ (often with more ecosystem data) | ✅ MSRC detail: KBs, builds, supersedence, parsed CVSS, MSRC/NVD/EPSS/KEV links |

Under the hood, the difference is the data source: this server parses the full MSRC CVRF monthly documents — the ProductTree, per-product severity threats, exploitability assessments, and KB remediation chains that per-CVE APIs never expose. That's what makes release-centric questions possible.

Other things it deliberately gets right:

- Zero API keys, zero accounts — the MSRC API is public; setup is one uvx command
- One tool, not thirty — a single consolidated msrc_search keeps your AI client's context lean and tool selection reliable
- Built for the monthly workflow — triage a release, brief your team, prioritize patching, then get on with your life

Try It Instantly — Hosted Endpoint (No Install)

A free remote instance is available at:

https://patch-tuesday-mcp.happyrock-b60185ec.eastus.azurecontainerapps.io/mcp

No account or API key needed. The endpoint serves the same public data as a local install — for heavy use or guaranteed availability, run it locally (below) or self-host your own. Only minimal, anonymized usage data is recorded — see Telemetry & Privacy.

Requirements

General

- Python 3.11+
- An MCP-compatible client (Claude Desktop, Cursor, Claude Code, GitHub Copilot CLI, etc.)

Using uvx (Recommended)

If you are installing or running the server via uvx, you must have uv installed first.

- uv (includes uvx): https://github.com/astral-sh/uv

Install uv:

```bash