Use Kevscope MCP with OpenAI Codex CLI

CVE patch-priority API + MCP: CISA KEV, EPSS, CVSS, SSVC. Keys $19/mo; 200 free calls/day.

Remote MCP server (Streamable HTTP), nothing to install. Free: 200 free calls/day · Paid: Keys $19/mo

Set it up

Open ~/.codex/config.toml (create it if needed).
Add the [mcp_servers] table shown and save.
Start Codex; the server's tools are available to the agent.
Ask a question the tools can answer.

Add to ~/.codex/config.toml:

[mcp_servers.kevscope-api]
url = "https://kevscope-api.cybermaxtools.com/mcp?via=use-with-codex"

With a paid key:

[mcp_servers.kevscope-api]
url = "https://kevscope-api.cybermaxtools.com/mcp?via=use-with-codex"
env_http_headers = { "x-api-key" = "CYBERMAX_API_KEY" }

env_http_headers maps the header to an environment variable name, so the key stays in your environment.

Where it goes:

~/.codex/config.toml (or .codex/config.toml in a trusted project)

Config format checked 2026-10-09 against OpenAI Codex CLI's MCP documentation.

Tools you get

Endpoint checked 2026-10-09: https://kevscope-api.cybermaxtools.com/mcp answered an MCP initialize (protocol 2025-06-18) and tools/list with 3 tools, all marked read-only. No key was used and no tool was called.

Tool	What it does	Required inputs
`cve_priority`	Patch-priority verdict for 1-20 CVE IDs with evidence: CISA KEV status (date added, due date, ransomware use), FIRST EPSS probability, CVSS (CNA or CISA-ADP), CISA SSVC exploitation/automatable/impact, vendor, product and links. Sorted most urgent first.	`cves`
`kev_recent`	CVEs added to the CISA Known Exploited Vulnerabilities catalog in the last N days, newest first, with due date, ransomware use and EPSS. Optional vendor/product text filter.	none
`epss_watchlist`	The highest-EPSS CVEs (most likely to be exploited in 30 days) that are not in CISA KEV yet. Defaults to this year's CVE IDs.	none

Test the endpoint from a terminal

This lists the tools without a key and without calling any of them:

curl -s https://kevscope-api.cybermaxtools.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

If it does not work

Each server is its own [mcp_servers.<name>] table; keep the name to letters, digits, dashes and underscores.
For a fixed header value instead of an environment variable, Codex also documents http_headers.
The free tier has a daily limit (see the pricing line above); a paid key raises it.

Kevscope in other clients

Cursor VS Code (GitHub Copilot)Claude Code Claude Desktop and claude.ai Windsurf (Devin Desktop)Cline Gemini CLI

More MCP servers for OpenAI Codex CLI

All Kevscope setups · All OpenAI Codex CLI setups · All