PocMap

AI-agent-optimized CVE / PoC / exploit discovery toolkit — CLI, Python API, and MCP server.

Docs: https://zebbern.github.io/pocmap/

Features

• Multi-source PoCs — GitHub, Exploit-DB, Metasploit, Nuclei, labs, bug bounty write-ups; curated indexes first, then GitHub Search fallback for index-lag CVEs
• MCP server — 22 tools for Claude Desktop, Cursor, and other MCP clients
• CLI + CI — table/json/csv/md/sarif output, exit-code contract, bulk --fail-on SARIF gate
• Cache & offline — persistent TTL'd HTTP cache and first-class --offline mode
• Bug bounty toolkit — Python API checklists, workflows, templates, scope (CLI bugbounty searches write-ups only)

Install

pip install pocmap
pip install "pocmap[server]"          # MCP SDK / pocmap-mcp
pip install -e ".[server,dev]"        # from a clone

Python 3.10+. Optional: GITHUB_API_TOKEN, NVD_API_KEY for higher rate limits.

More: Getting started · Configuration

Quick start

pocmap lookup CVE-2021-44228
pocmap bulk cves.txt --format sarif --fail-on kev
pocmap latest --since 7d --severity critical --only-with-poc
pocmap discover "Log4j" --version 2.x
pocmap package PyPI django --version 3.2.0
pocmap doctor
pocmap lookup CVE-2021-44228 --format json
pocmap --offline lookup CVE-2021-44228

pocmap --help lists all commands. Guides: CLI reference.

MCP Server Setup

Recommended: uv on PATH, no local clone required. --from pocmap[server] pulls the package with the MCP SDK and runs the pocmap-mcp console script over STDIO.

{
  "mcpServers": {
    "pocmap": {
      "command": "uvx",
      "args": ["--from", "pocmap[server]", "pocmap-mcp"],
      "env": {
        "GITHUB_API_TOKEN": "ghp_xxxxxxxxxxxx",
        "NVD_API_KEY": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      }
    }
  }
}

Pin a release by changing the package arg to pocmap[server]==X.Y.Z; keep pocmap-mcp as the last arg. Optional env vars raise GitHub / NVD rate limits.

Running the MCP Server

Requires the [server] extra (MCP SDK). Protocol revisions up to 2026-07-28 are supported; STDIO clients typically negotiate 2025-11-25 at initialize.

pip install "pocmap[server]"
# or from a clone: pip install -e ".[server]"

# STDIO (default — what Claude Desktop / Cursor / most MCP clients expect)
pocmap-mcp
python -m pocmap.mcp_server

# Other transports / flags
pocmap-mcp --transport sse
pocmap-mcp --transport http --host 127.0.0.1 --port 9000
# Non-loopback HTTP/SSE requires a bearer token
POCMAP_MCP_AUTH_TOKEN='replace-with-a-long-random-token' \
  pocmap-mcp --transport http --host 0.0.0.0 --port 9000
pocmap-mcp --debug

STDIO does not use MCP HTTP authentication. Network transports allow an unauthenticated loopback bind (127.0.0.1, localhost, or ::1). Any other bind address requires POCMAP_MCP_AUTH_TOKEN; when set, every HTTP and SSE request must send Authorization: Bearer <token>. The server does not log the token. Network requests are rate-limited per authenticated principal by default to 60 requests per 60 seconds. Set POCMAP_MCP_RATE_LIMIT and POCMAP_MCP_RATE_WINDOW_SECONDS to change those limits. Bearer tokens are credentials: use HTTPS or a trusted TLS-terminating ingress before exposing a non-loopback bind. The built-in listener does not provide TLS. The configured token is the single operator principal authorized to call all MCP tools; invalid credentials are rate-limited separately by client address.

MCP Tools (22 Total)

MCP Resources

Example Agent Workflow

User: "Should I prioritize CVE-2021-44228, CVE-2023-38408, or CVE-2024-21413?"

Agent:
1. generate_json_report("CVE-2021-44228,CVE-2023-38408,CVE-2024-21413")
2. Read each entry's triage.priority / reasons (KEV, EPSS, exploit counts)
3. Prefer Log4j when triage shows KEV + highest EPSS + most PoCs

PoC-only ask → find_github_pocs (check labels / trust_score / sources). Dependency ask → discover_package_cves (use canonical_cve + aliases, not product discovery).

Claude Desktop / Cursor JSON configs and transports: Getting started → MCP. Tool inventory: MCP tools. Agent contract: .claude/skills/pocmap-agent/references/mcp_tools.md.

Python API

from pocmap.services.cve_service import CVEService

with CVEService() as svc:
    info = svc.get_cve_info("CVE-2021-44228")
print(info.cvss.base_score, info.kev_status, info.epss)

Full service examples: Python API.

Docs

License

MIT — see LICENSE.

PocMap is a research and defensive tool. Always operate within applicable law and program scope.