Metadata-Version: 2.5
Name: noevika-mcp
Version: 0.1.0
Summary: Model Context Protocol server for Noevika — the deduplicated cyber-incident record, as tools for AI assistants and agents.
Project-URL: Homepage, https://noevika.com
Project-URL: Source, https://github.com/pvovveti/noevika/tree/main/mcp
License-Expression: Apache-2.0
Keywords: breach,cve,cybersecurity,mcp,ransomware,threat-intelligence
Requires-Python: >=3.10
Requires-Dist: httpx>=0.27
Requires-Dist: mcp>=2.0
Description-Content-Type: text/markdown

# noevika-mcp

A [Model Context Protocol](https://modelcontextprotocol.io) server that gives AI assistants and agents direct access to [Noevika](https://noevika.com) — the deduplicated record of cyber incidents (breaches, ransomware claims, exploited CVEs, advisories) from government registries and security news. No browser needed: ask Claude, Cursor, or your own agent *"has Acme Health filed a breach before?"* and it queries Noevika.

## Tools

| Tool | What it answers |
|---|---|
| `search_incidents(sector, type, keyword, limit, sort)` | What happened recently, filtered |
| `get_incident(incident_id)` | One incident with every source that covered it and CVE context |
| `organisation_timeline(name)` | Everything about one company — news → HHS → state AG → SEC |
| `threat_actor(name)` | A ransomware group's claims by sector and month |
| `directory(kind, limit)` | Most-reported organisations or actors |
| `cve_context(cve)` | KEV status, EPSS, due date, ransomware use, vendor advisory |
| `trends(period | start,end)` | Period overview with comparison |
| `watchlist()`, `watch(kind, value)` | Your watchlist — needs an API key |
| `vendors()` | Your vendor portfolio — needs an API key |

Public tools work without a key. For account tools, create a key at https://noevika.com/preferences/ and set `NOEVIKA_API_KEY`.

## Claude Desktop / Cursor / Claude Code

Add to the client's MCP configuration (`claude_desktop_config.json`, `.cursor/mcp.json`, …). Requires [uv](https://docs.astral.sh/uv/) (`pip install uv`).

```json
{
  "mcpServers": {
    "noevika": {
      "command": "uvx",
      "args": ["noevika-mcp"],
      "env": { "NOEVIKA_API_KEY": "nvk_…" }
    }
  }
}
```

Or install once and run `noevika-mcp` as the command: `pip install noevika-mcp`.

## Remote endpoint — nothing to install

Noevika also serves MCP directly at **`https://api.noevika.com/mcp`** (Streamable HTTP, stateless). Add it as a remote/custom connector in any client that supports URLs:

- **Claude Code:** `claude mcp add --transport http noevika https://api.noevika.com/mcp --header "X-Api-Key: nvk_…"`
- **Claude.ai / Claude Desktop → Settings → Connectors → Add custom connector:** URL `https://api.noevika.com/mcp` (public tools work without a key; account tools need the header, where the client supports custom headers)
- **Cursor / other clients:** `{"url": "https://api.noevika.com/mcp", "headers": {"X-Api-Key": "nvk_…"}}`

Same ten tools; the remote endpoint reads the record directly, so it is the faster of the two. The stdio package remains for clients that only run local servers, and for self-hosted instances. You can also run this package as a local HTTP server: `noevika-mcp --http --port 8787`.

## Attribution

Every result includes `url` (the original publisher) and `page` (the Noevika page). Keep the publisher link when you relay an item — it is what the sources are owed.

## Environment

| Variable | Default | Purpose |
|---|---|---|
| `NOEVIKA_API_KEY` | — | Account tools; raises read page size to 500 |
| `NOEVIKA_API_URL` | `https://api.noevika.com` | Point at a self-hosted instance |

Apache-2.0. Source and issues: https://github.com/pvovveti/noevika
