mitre-cwe-mcp-server

Get CWE hierarchy

cwe_get_hierarchy

Read-onlyIdempotent

Navigate live CWE parents, children, ancestors, or descendants for a weakness, category, grouping, or view. Discover IDs with cwe_search_weaknesses or cwe_list_reference topic views. The default view is 1000; set viewId all for every view. primaryOnly applies only to ancestors. Edges point from parent to child and retain view identity; follow nextCursor for more edges. Continuations re-fetch the traversal and reject changed topology. Empty relations are successful; upstream failures remain errors. Node names come from the loaded catalog and may lag live IDs.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>",
      "direction": "<direction>"
    },
    "name": "cwe_get_hierarchy"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes	CWE ID such as CWE-79 or 79, for a weakness, category, grouping, or view.
`limit`	No	Maximum page size; capped at 100 items with disclosure.
`cursor`	No	Opaque continuation returned by this tool.
`viewId`	No	CWE view ID such as CWE-1000 or 1000, or all; discover with cwe_list_reference topic views. Blank means the default.	1000
`direction`	Yes	Live hierarchy direction.
`primaryOnly`	No	Restrict ancestors to primary parents; invalid for other directions when true.

Output Schema

Name	Required	Description
`id`	No	Canonical queried root ID.
`cap`	No	Effective edge page cap.
`edges`	No	Deterministically ordered edge page.
`error`	No	Present when the call failed. Absent on success.
`found`	No	Whether the root exists according to the live hierarchy response.
`nodes`	No	Endpoint nodes of this page's edges; the first page also lists roots without edges.
`shown`	No	Returned edge count.
`notice`	No	Paging cap or source drift notice.
`viewId`	No	Canonical selected view or all.
`guidance`	No	Recovery guidance for an unknown root.
`direction`	No	Applied traversal direction.
`truncated`	No	Whether additional edges remain.
`pagination`	No	Local result pagination.
`provenance`	No	Loaded catalog provenance.
`totalCount`	No	Full traversal edge count.
`primaryOnly`	No	Applied primary ancestor restriction.
`retrievedAt`	No	Live retrieval time in ISO format.
`appliedFilters`	No	Normalized traversal and paging inputs.
`hierarchyFingerprint`	No	Full traversal and catalog version fingerprint.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 11, 2026

changedInput schema / properties / limit / description

Previous value: -"Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."New value: +"Maximum page size; capped at 100 items with disclosure."

Changed1 schema field changedNov 2, 2026

changedInput schema / properties / id / description

Previous value: -"CWE ID such as CWE-79 or 79, for a weakness, category, or view."New value: +"CWE ID such as CWE-79 or 79, for a weakness, category, grouping, or view."

Changed2 schema fields changedOct 24, 2026

changedOutput schema / properties / error / properties / data / properties / reason / description

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_hierarchy_options`: viewId names no CWE view, or primaryOnly is true outside ancestors; the message names each. `hierarchy_unavailable`: The live response is inconsistent or a locally known root returns 404. `queue_full`: The live hierarchy service has no available request slot. `invalid_cursor`: Traversal, query, or catalog changed since the cursor was created. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `hierarchy_timeout`: The total hierarchy deadline expires during queue wait or an active traversal. `invalid_hierarchy_options`: viewId names no CWE view, or primaryOnly is true outside ancestors; the message names each. `hierarchy_unavailable`: The live response is inconsistent or a locally known root returns 404. `queue_full`: The live hierarchy service has no available request slot. `invalid_cursor`: Traversal, query, or catalog changed since the cursor was created. Other values are possible when a failure originates below the handler."

changedOutput schema / properties / error / properties / data / properties / reason / examples

Previous value: -[
-  "invalid_hierarchy_options",
-  "hierarchy_unavailable",
-  "queue_full",
-  "invalid_cursor"
-]New value: +[
+  "hierarchy_timeout",
+  "invalid_hierarchy_options",
+  "hierarchy_unavailable",
+  "queue_full",
+  "invalid_cursor"
+]

First observedOct 23, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, but the description adds substance they do not cover: edge direction (parent to child), view identity retention, cursor continuation semantics, rejected continuations when topology changes, empty relations counting as success, upstream failures remaining errors, and catalog names lagging live IDs. These are non-obvious behaviors an agent must anticipate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then constraints, then behavioral caveats; every sentence carries information. It is densely clause-packed without grouping, which makes the pagination and error-handling details slightly harder to scan, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, cursor-paginated graph traversal with an output schema present, the description covers traversal scope, defaults, pagination, failure semantics, and data-staleness caveats. Return-value shape is rightly left to the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description reinforces the cross-parameter constraint (primaryOnly only for ancestors) and the viewId default/'all' semantics in prose. It adds modest reinforcement rather than new meaning, since the schema already documents each field.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource: 'Navigate live CWE parents, children, ancestors, or descendants' across four node types (weakness, category, grouping, view). An agent can distinguish this traversal tool from siblings like cwe_get_weakness or cwe_get_view without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It routes the agent to cwe_search_weaknesses or cwe_list_reference topic views for ID discovery, states the default view (1000) and the 'all' option, and warns that primaryOnly applies only to ancestors. What is missing is an explicit exclusion, e.g. that this returns topology rather than weakness details, which would separate it cleanly from cwe_get_weakness.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mitre-cwe-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.