redhat-security-data-api-mcp CLAUDE.md

Red Hat Security Data API MCP Server

What This Is

A Model Context Protocol (MCP) server written in TypeScript that wraps the Red Hat Security Data API v1.0. It gives LLMs like Claude live access to query CSAF advisories, CVEs, and OVAL stream data through six typed tools.

Project Structure

src/
  index.ts              MCP server entry point — registers all 6 tools on stdio transport
  api-client.ts         HTTP client — fetch-based, gzip-aware, configurable base URL
  tools/
    csaf.ts             search_csaf, get_csaf_details (Zod schemas + handlers)
    cve.ts              search_cves, get_cve_details
    oval.ts             list_oval_streams, get_oval_stream
skills/
  redhat-security-data/
    SKILL.md            Claude skill — investigation patterns, tool chaining, domain knowledge
docs/
  building.md           Build from source, container (Podman), env vars
  claude-desktop-setup.md  Claude Desktop and Claude Code MCP client config
  tools.md              Parameter reference for all six tools
Containerfile           Multi-stage production build (node:20-alpine)
build.sh                Podman container image build script
podman-compose.yml      Local testing with podman compose

Tech Stack

• Language: TypeScript (Node.js v20+, ES2022, Node16 module resolution)
• MCP SDK: @modelcontextprotocol/sdk — McpServer class with StdioServerTransport
• Validation: zod — all tool inputs have Zod schemas with LLM-facing descriptions
• HTTP: Native fetch (no axios) — the API returns gzip by default and fetch handles it
• Container: node:20-alpine, multi-stage build, runs as node user

MCP Tools

Tool	API Endpoint	Purpose
search_csaf	GET /csaf.json	Search advisories by date, severity, CVE, package, RHSA ID
get_csaf_details	GET /csaf/{RHSA_ID}.json	Full CSAF/VEX document for one advisory
search_cves	GET /cve.json	Search CVEs by date, severity, CVSS, CWE, package, product
get_cve_details	GET /cve/{CVE_ID}.json	Full CVE details: severity, CVSS, affected releases, mitigation
list_oval_streams	GET /oval/ovalstreams.json	List OVAL v2 streams by label or date
get_oval_stream	GET /oval/ovalstreams/{BASE}.json	OVAL definitions for a product (e.g. RHEL9)