# PocMap MCP server

> Enables AI agents to discover CVE details, exploit PoCs, Metasploit modules, and Nuclei templates across multiple security intelligence sources.

- Repository: https://github.com/zebbern/pocmap
- Page: https://hostedmcp.org/servers/zebbern/pocmap
- Transport: —
- Stars: 7
- License: MIT

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `GITHUB_API_TOKEN` | no | no |  |
| `NVD_API_KEY` | no | no |  |
| `POCMAP_MCP_AUTH_TOKEN` | no | no |  |

## Tools (22)

- `lookup_cve`
- `get_epss_score`
- `check_kev_status`
- `get_attack_techniques`
- `find_github_pocs`
- `verify_github_pocs`
- `find_metasploit_module`
- `find_exploitdb_entry`
- `find_nuclei_template`
- `find_bug_bounty_reports`
- `find_practice_labs`
- `find_vulhub_docker`
- `find_recent_exploits`
- `discover_product_cves`
- `discover_package_cves`
- `cve_to_cpe`
- `cpe_to_cve`
- `generate_json_report`
- `generate_html_report`
- `get_cve_assessment_playbook`
- `get_rapid_response_playbook`
- `get_bug_bounty_playbook`

## FAQ

### What sources does PocMap use for PoC discovery?

It searches GitHub, Exploit-DB, Metasploit, Nuclei, labs, and bug bounty write-ups.

### Can I use PocMap without an internet connection?

Yes, the toolkit includes a first-class --offline mode and a persistent TTL'd HTTP cache.

### How can I increase rate limits for GitHub and NVD?

You can provide a GITHUB_API_TOKEN or NVD_API_KEY in your environment variables.

### Does the MCP server support network transports?

Yes, it supports STDIO, SSE, and HTTP transports.