Critical Severity
Published: Nov 14, 2026
Local security intelligence for CVE triage and remediation, with built-in SBOM functionality. 46 data sources and 42 tools, risk scores, fix plans for what you run, and an MCP server for AI agents - all built in native Rust. Private by default.
<h1 align="center">CVE Intel</h1>
<p align="center">
Know which vulnerabilities matter, and what to do about them.<br/>
A private desktop app for vulnerability triage and scanning, written in native Rust, with a CLI, REST API and MCP server for developers and AI agents.<br/>
42 MCP tools, 46 data sources, SBOMs in and out, on-device AI.
</p>
<p align="center">
<a href="https://www.rust-lang.org"><img src="https://img.shields.io/badge/Rust-native-orange?style=flat-square&logo=rust" alt="Rust"/></a>
<a href="https://tauri.app"><img src="https://img.shields.io/badge/Tauri-2-blue?style=flat-square" alt="Tauri 2"/></a>
<a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP-Compatible-blue?style=flat-square" alt="MCP compatible"/></a>
<a href="#license"><img src="https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-green?style=flat-square" alt="License: MIT OR Apache-2.0"/></a>
</p>
<p align="center">
<a href="#what-is-cve-intel">What it is</a> ·
<a href="#getting-started">Getting started</a> ·
<a href="#features">Features</a> ·
<a href="#install">Install</a> ·
<a href="#local-ai">Local AI</a> ·
<a href="#data-sources">Data sources</a> ·
<a href="#developer-notes">Developer notes</a> ·
<a href="#citing-and-attribution">Citing</a>
</p>
<p align="center">
<a href="assets/remediation-lab-demo.mp4"><img src="assets/remediation-lab-demo.webp" width="900" alt="Sped-up screen recording of CVE Intel on macOS: triage of CVE-2024-6387 and its How to fix it card, then the Remediation Lab: the plan for openssh on Ubuntu 22.04 with Ubuntu's own build first, ticking the fix and opening its runbook, ticking Ubuntu's mitigation instead and watching the SSVC decision move from Attend to Track, saving that as a decision and finding it in the ledger, then PAN-OS 10.2.8 with its hotfix and workaround, RHEL 8 as not affected, log4j-core, and Plan fix from a scan of lodash 4.17.20"/></a>
</p>
<p align="center"><sub>Sped-