Skip to main content
Glama

mitre-cwe-mcp-server

Get CWE hierarchy

cwe_get_hierarchy
Read-onlyIdempotent

Navigate live CWE parents, children, ancestors, or descendants for a weakness, category, or view. Discover IDs with cwe_search_weaknesses or cwe_list_reference topic views. The default view is 1000; set viewId all for every view. primaryOnly applies only to ancestors. Edges point from parent to child and retain view identity; follow nextCursor for more edges. Continuations re-fetch the traversal and reject changed topology. Empty relations are successful; upstream failures remain errors. Node names come from the loaded catalog and may lag live IDs.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idYesCWE ID such as CWE-79 or 79, for a weakness, category, or view.
limitNoMaximum page size; capped at 100 and a 24,000-byte response budget with disclosure.
cursorNoOpaque continuation returned by this tool.
viewIdNoCWE view ID such as CWE-1000 or 1000, or all; discover with cwe_list_reference topic views. Blank means the default.1000
directionYesLive hierarchy direction.
primaryOnlyNoRestrict ancestors to primary parents; invalid for other directions when true.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
idNoCanonical queried root ID.
capNoEffective edge page cap.
edgesNoDeterministically ordered edge page.
errorNoPresent when the call failed. Absent on success.
foundNoWhether the root exists according to the live hierarchy response.
nodesNoEndpoint nodes of this page's edges; the first page also lists roots without edges.
shownNoReturned edge count.
noticeNoPaging cap or source drift notice.
viewIdNoCanonical selected view or all.
guidanceNoRecovery guidance for an unknown root.
directionNoApplied traversal direction.
truncatedNoWhether additional edges remain.
paginationNoLocal result pagination.
provenanceNoLoaded catalog provenance.
totalCountNoFull traversal edge count.
primaryOnlyNoApplied primary ancestor restriction.
retrievedAtNoLive retrieval time in ISO format.
appliedFiltersNoNormalized traversal and paging inputs.
hierarchyFingerprintNoFull traversal and catalog version fingerprint.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnly/idempotent/openWorld; the description goes well beyond them by explaining edge orientation (parent to child with view identity retained), cursor continuation semantics including re-fetch and rejection of changed topology, that empty relations succeed while upstream failures error, and that node names may lag live IDs. These are non-obvious behaviors an agent could not infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose leads, then discovery, then parameter rules, then edge/pagination semantics, then error and freshness caveats – a sensible ordering with no filler. The telegraphic clauses about topology rejection and catalog lag are dense but each carries real information rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With six parameters, an output schema, and full annotation coverage, the description supplies exactly the missing behavioral layer: pagination, error/success distinctions, and catalog staleness. Nothing needed to call the tool correctly is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and already documents id format, limit caps, cursor opacity, viewId default/all, and primaryOnly's restriction, so the description's viewId/primaryOnly notes largely restate the schema. Only the cursor follow-next and default-view framing add slight value, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a specific verb (navigate) plus resource (CWE hierarchy) and enumerates the four relation types, so an agent immediately knows this is traversal, not lookup. It explicitly routes ID discovery to cwe_search_weaknesses and cwe_list_reference, separating it from the get_* siblings that return a single node.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states how to obtain IDs, what the default view is (1000), how to span all views (viewId all), and that primaryOnly is valid only for ancestors. What it doesn't do is contrast traversal with cwe_get_weakness/cwe_get_view when the agent already has an ID, so the when-not-to-use case is left implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.