SiteCheck Web Intel

One CVE record from the NIST National Vulnerability

security_cve_nvd_lookup

Read-only

One CVE record from the NIST National Vulnerability Database: description, published and last-modified dates, NVD status, primary CVSS score and severity (v4.0, 3.1, 3.0 or 2.0, whichever NVD marks primary first), CWE weakness IDs and up to 5 reference URLs. It does not say whether the CVE is being exploited (use cisa-known-exploits or epss-exploit-score for that). Related tools on this server, for a different need: security_cve_details_feed when you need Vulnerability trend for a vendor from the NIST NVD: CVEs. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cveId": "<cveId>"
    },
    "name": "security_cve_nvd_lookup"
  }
}

Input Schema

Name	Required	Description	Default
`cveId`	Yes	CVE identifier such as CVE-2021-44228 (required)

Output Schema

Name	Required	Description	Default
`id`	No
`cwe`	No
`cvss`	No
`source`	No
`status`	No
`checkedAt`	No
`published`	No
`references`	No
`description`	No
`lastModified`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, yet the description still adds material facts: the call costs $0.002 USDC via x402 on Base/Solana/Arc, failed calls are not charged, and the record is capped at 5 references with CVSS selected by NVD's primary marking. The only gap is that it doesn't explain the payment flow or what a failed call looks like operationally.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The payload is front-loaded correctly, starting with what the record contains before the exclusions and pricing. However, the sentence 'Related tools on this server, for a different need: security_cve_details_feed when you need Vulnerability trend for a vendor from the NIST NVD: CVEs' is syntactically broken filler that costs reading time without adding clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is optional, yet the description still sketches the record's field set and its caps, and it covers cost, billing failure behavior, and scope boundaries. Combined with a fully documented single parameter, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema description coverage, so the schema already documents cveId and even supplies a CVE-2021-44228 example. The description adds nothing about identifier formatting or case sensitivity beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('One CVE record from the NIST National Vulnerability Database') and then enumerates exactly what the record contains: description, published/last-modified dates, NVD status, primary CVSS score and severity, CWE IDs, and up to 5 reference URLs. It also names adjacent tools with different purposes (cisa-known-exploits, epss-exploit-score), so an agent can distinguish it from siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit exclusion ('It does not say whether the CVE is being exploited') paired with the correct alternatives for that need, which is exactly the when-not-to-use guidance that prevents mis-selection. The pointer to security_cve_details_feed for vendor trend data is somewhat garbled in phrasing but still routes the agent correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?