Skip to main content
Glama

mitre-cwe-mcp-server

Retrieve CWE weaknesses

cwe_get_weakness
Read-onlyIdempotent

Retrieve CWE weaknesses or categories by ID, such as CWE-79, CWE79, or 79. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a view, a CAPEC ID, or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Defaults to summary, consequences, mitigations, and relations; a default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). Summary carries recorded alternate terms such as XSS, ordinalities (Primary, Resultant, Indirect), and background details; the notes section, outside the defaults, returns every note MITRE records, such as Relationship, Maintenance, Terminology, and Research Gap notes. Explicit sections remain complete, including one oversized record with disclosure; an empty sections array requests an outline. exampleLanguage, exampleOffset, and exampleLimit select a complete source-ordered page of section examples: with sections omitted, setting any of them to a non-default value adds examples after the defaults, filled last and outlined with its page size and a re-call when it does not fit; explicit sections without examples ignore them, and guidance gives the re-call that adds examples. Categories are organizational entries, not vulnerability root causes.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idsYesOne to 200 submitted IDs; up to 20 distinct items are processed within the response budget.
sectionsNoSelected sections; omit for defaults, or pass an empty array for an outline.
exampleLimitNoComplete examples per entry in section examples; no upper bound beyond the finite source array. With sections omitted, a value other than 3 adds examples to the defaults.
exampleOffsetNoOffset in each entry’s language-filtered examples (section examples). With sections omitted, a value above 0 adds examples to the defaults.
exampleLanguageNoExact source example code language for section examples; discover values through cwe_list_reference topic platforms. With sections omitted, adds examples to the defaults.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
capNoMaximum identifiers processed per call.
errorNoPresent when the call failed. Absent on success.
shownNoIdentifiers processed.
noticeNoWhole-identifier continuation and budget disclosure.
entriesNoFound projected entries in request order.
guidanceNoCall-level guidance: deferred-ID continuation, budget disclosure, and the re-call for parameters the selected sections leave unused.
notFoundNoPer-ID misses; an all-missing batch is success.
truncatedNoWhether the count or response budget deferred identifiers.
provenanceNoLoaded catalog provenance.
totalCountNoDistinct submitted identifiers before the batch cap.
deferredIdsNoDistinct items to submit in a later call: canonical IDs, or the collapsed text of an item that is no ID.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

On top of readOnly/openWorld/idempotent annotations, the description discloses a great deal of behavior beyond them: a 20-distinct-ID cap inside a 24,000-byte budget with deferred IDs named, whole-section omission marked with size and 'kind partial', completion guarantees for explicit sections including oversized records, and precise rejection rules (control characters, non-ID items over 150 characters). This is exactly the context an agent needs to interpret a partial result rather than retry blindly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Nearly every clause carries information, but the middle sentences are long semicolon-chained runs that are hard to parse on first read, and the example-paging semantics are restated across the description and multiple schema fields. The single most important fact (batch limits) is front-loaded, but overall structure is dense rather than crisp.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, rich annotations, and full schema coverage, the description rounds out the remaining gaps: budget behavior, partial-result semantics, rejection conditions, default vs explicit section behavior, and example paging. An agent can call this correctly and interpret truncated responses without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the property descriptions already repeat much of the budget and example-paging semantics, so the baseline is 3. The description still adds value by explaining the interaction rules -- that example parameters are ignored under explicit sections, that paging is source-ordered and language-filtered, and that the page is outlined with its size and a re-call -- which the schema only states piecemeal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and resource plus concrete accepted ID formats (CWE-79, CWE79, 79), and closes by clarifying that categories are organizational entries rather than root causes. Sibling differentiation is only implicit -- it notes that a view or CAPEC ID lands in notFound, which gestures at cwe_get_view / cwe_get_attack_pattern without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes clear operating context: defaults when sections is omitted, an outline for an empty array, and that explicit sections without examples ignore the example parameters. It also functions as a soft exclusion by stating that views and CAPEC IDs return in notFound with recovery guidance, but it never explicitly routes the agent to cwe_search_weaknesses for discovering IDs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.