Skip to main content
Glama
Sign In

mitre-cwe-mcp-server

by io.github.cyanheads
OverviewDiscussionsAdmin

Retrieve CWE weaknesses

cwe_get_weakness
Read-onlyIdempotent

Retrieve CWE weaknesses, categories, or groupings by ID, such as CWE-79, CWE79, or 79. Processes the first 20 distinct positions in submission order and lists later positions in deferredIds; a view, a CAPEC ID, or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Defaults to summary, consequences, mitigations, and relations. Summary carries recorded alternate terms such as XSS, ordinalities (Primary, Resultant, Indirect), and background details; the notes section, outside the defaults, returns every note MITRE records, such as Relationship, Maintenance, Terminology, and Research Gap notes. Selected sections are complete; an empty sections array requests an outline with section sizes. exampleLanguage, exampleOffset, and exampleLimit select a complete source-ordered page of section examples: with sections omitted, setting any of them to a non-default value adds examples after the defaults; explicit sections without examples ignore them, and guidance gives the re-call that adds examples. Categories and groupings are organizational entries, not vulnerability root causes.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "ids": "<ids>"
    },
    "name": "cwe_get_weakness"
  }
}

Input Schema

NameRequiredDescriptionDefault
idsYesOne or more IDs. The first 20 distinct positions are processed; later positions are returned in deferredIds.
sectionsNoSelected sections; omit for defaults, or pass an empty array for an outline.
exampleLimitNoComplete examples per entry in section examples; no upper bound beyond the finite source array. With sections omitted, a value other than 3 adds examples to the defaults.
exampleOffsetNoOffset in each entry’s language-filtered examples (section examples). With sections omitted, a value above 0 adds examples to the defaults.
exampleLanguageNoExact source example code language for section examples; discover values through cwe_list_reference topic platforms. With sections omitted, adds examples to the defaults.

Output Schema

NameRequiredDescriptionDefault
capNoMaximum identifiers processed per call.
errorNoPresent when the call failed. Absent on success.
shownNoIdentifiers processed.
noticeNoHow to continue with deferred IDs.
entriesNoFound projected entries in request order.
guidanceNoCall-level guidance: deferred-ID continuation and the re-call for parameters the selected sections leave unused.
notFoundNoPer-ID misses; an all-missing batch is success.
truncatedNoWhether the 20-position cap deferred identifiers.
provenanceNoLoaded catalog provenance.
totalCountNoDistinct submitted identifiers before the batch cap.
deferredIdsNoDistinct items to submit in a later call: canonical IDs, or the collapsed text of an item that is no ID.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed9 schema fields changed
    • changedInput schema / properties / ids / description
      Previous value: -"One to 200 submitted IDs; up to 20 distinct items are processed within the response budget."New value: +"One or more IDs. The first 20 distinct positions are processed; later positions are returned in deferredIds."
    • removedInput schema / properties / ids / maxItems
      Removed value: -200
    • changedOutput schema / properties / entries / items / properties / kind / description
      Previous value: -"full: every selected section the entry has, complete. partial: the sections of a default selection that fit the 24,000-byte response budget, complete, with the omitted ones in outline. outline: identity and section sizes only."New value: +"full: every selected section the entry has, complete. outline: identity and section sizes only."
    • changedOutput schema / properties / entries / items / properties / kind / enum
      Previous value: -[
-  "full",
-  "partial",
-  "outline"
-]New value: +[
+  "full",
+  "outline"
+]
    • addedOutput schema / properties / entries / items / properties / mappingNotes / properties / suggestions
      Added value: +{
+  "description": "Recorded mapping suggestions in source order.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Recorded alternative for vulnerability mapping.",
+    "properties": {
+      "comment": {
+        "description": "Source suggestion comment.",
+        "type": "string"
+      },
+      "id": {
+        "description": "Suggested CWE ID.",
+        "type": "string"
+      },
+      "name": {
+        "description": "Resolved target name when loaded.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "id"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / entries / items / properties / outline / description
      Previous value: -"Sections available but not included in this entry, with sizes: every available section of an outline, or the selected sections a partial entry omitted."New value: +"All available sections and their sizes, returned for an explicit outline."
    • changedOutput schema / properties / guidance / description
      Previous value: -"Call-level guidance: deferred-ID continuation, budget disclosure, and the re-call for parameters the selected sections leave unused."New value: +"Call-level guidance: deferred-ID continuation and the re-call for parameters the selected sections leave unused."
    • changedOutput schema / properties / notice / description
      Previous value: -"Whole-identifier continuation and budget disclosure."New value: +"How to continue with deferred IDs."
    • changedOutput schema / properties / truncated / description
      Previous value: -"Whether the count or response budget deferred identifiers."New value: +"Whether the 20-position cap deferred identifiers."
  2. Changed28 schema fields changed
    • changedOutput schema / properties / entries / items / description
      Previous value: -"Projected CWE weakness or category."New value: +"Projected CWE weakness, category, or grouping."
    • addedOutput schema / properties / entries / items / properties / alternateTerms / items / properties / roles
      Added value: +{
+  "description": "Recorded alternate-term roles in source order.",
+  "items": {
+    "description": "Recorded alternate-term roles in source order.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / detectionMethods / items / properties / phaseDetails
      Added value: +{
+  "description": "All source phases in order, including domain metadata when custom phases occur.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Ordered source phase with its custom domain when present.",
+    "properties": {
+      "domain": {
+        "description": "Domain of a custom phase; absent for a standard phase.",
+        "type": "string"
+      },
+      "phase": {
+        "description": "Source phase.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "phase"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / detectionMethods / items / properties / phases
      Added value: +{
+  "description": "Detection phases.",
+  "items": {
+    "description": "Detection phases.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / dimensions
      Added value: +{
+  "description": "Recorded dimensions in source order.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Recorded typed dimension.",
+    "properties": {
+      "type": {
+        "description": "Source dimension type.",
+        "type": "string"
+      },
+      "value": {
+        "description": "Source dimension value.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / examples / items / properties / references / items / properties / accessRestrictions
      Added value: +{
+  "description": "Source access-restriction label.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / examples / items / properties / references / items / properties / altUrl
      Added value: +{
+  "description": "Alternative reference URL.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / examples / items / properties / references / items / properties / altUrlDate
      Added value: +{
+  "description": "Alternative URL access date.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / examples / items / properties / references / items / properties / mediaTypes
      Added value: +{
+  "description": "Source media-type labels.",
+  "items": {
+    "description": "Source media-type labels.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / examples / items / properties / references / items / properties / rationales
      Added value: +{
+  "description": "Source reference rationale labels.",
+  "items": {
+    "description": "Source reference rationale labels.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / entries / items / properties / members / description
      Previous value: -"Direct category members in source order."New value: +"Direct category or grouping members in source order."
    • addedOutput schema / properties / entries / items / properties / members / items / properties / dimensions
      Added value: +{
+  "description": "Recorded dimensions in source order.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Recorded typed dimension.",
+    "properties": {
+      "type": {
+        "description": "Source dimension type.",
+        "type": "string"
+      },
+      "value": {
+        "description": "Source dimension value.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / entries / items / properties / members / items / properties / type / enum
      Previous value: -[
-  "weakness",
-  "category",
-  "view"
-]New value: +[
+  "weakness",
+  "category",
+  "grouping",
+  "view"
+]
    • addedOutput schema / properties / entries / items / properties / mitigations / items / properties / phaseDetails
      Added value: +{
+  "description": "All source phases in order, including domain metadata when custom phases occur.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Ordered source phase with its custom domain when present.",
+    "properties": {
+      "domain": {
+        "description": "Domain of a custom phase; absent for a standard phase.",
+        "type": "string"
+      },
+      "phase": {
+        "description": "Source phase.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "phase"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / modesOfIntroduction / items / properties / domain
      Added value: +{
+  "description": "Source domain of a custom introduction phase.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / notes / items / properties / releaseDate
      Added value: +{
+  "description": "Source note release date.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / notes / items / properties / version
      Added value: +{
+  "description": "Source note version.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / observedExamples / items / properties / rationales
      Added value: +{
+  "description": "Source observed-example rationale labels.",
+  "items": {
+    "description": "Source observed-example rationale labels.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / platforms / items / properties / note
      Added value: +{
+  "description": "Source platform note in CommonMark.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / references / items / properties / accessRestrictions
      Added value: +{
+  "description": "Source access-restriction label.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / references / items / properties / altUrl
      Added value: +{
+  "description": "Alternative reference URL.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / references / items / properties / altUrlDate
      Added value: +{
+  "description": "Alternative URL access date.",
+  "type": "string"
+}
    • addedOutput schema / properties / entries / items / properties / references / items / properties / mediaTypes
      Added value: +{
+  "description": "Source media-type labels.",
+  "items": {
+    "description": "Source media-type labels.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / references / items / properties / rationales
      Added value: +{
+  "description": "Source reference rationale labels.",
+  "items": {
+    "description": "Source reference rationale labels.",
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / relatedWeaknesses / items / properties / dimensions
      Added value: +{
+  "description": "Recorded dimensions in source order.",
+  "items": {
+    "additionalProperties": false,
+    "description": "Recorded typed dimension.",
+    "properties": {
+      "type": {
+        "description": "Source dimension type.",
+        "type": "string"
+      },
+      "value": {
+        "description": "Source dimension value.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / entries / items / properties / technicalNuance
      Added value: +{
+  "description": "Complete technical nuance in CommonMark.",
+  "type": "string"
+}
    • changedOutput schema / properties / entries / items / properties / type / enum
      Previous value: -[
-  "weakness",
-  "category"
-]New value: +[
+  "weakness",
+  "category",
+  "grouping"
+]
    • addedOutput schema / properties / entries / items / properties / unphasedIntroductionNotes
      Added value: +{
+  "description": "Source notes on introductions with no phases, in CommonMark.",
+  "items": {
+    "description": "Source notes on introductions with no phases, in CommonMark.",
+    "type": "string"
+  },
+  "type": "array"
+}
  3. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly/idempotent/openWorld, yet the description still adds substantial behavior: a 20-item processing cap with deferredIds overflow, per-item notFound with recovery guidance, and the precise failure envelope (only control characters or oversized non-ID items reject the whole call). It also documents default section behavior and the notes section being outside the defaults, which the agent cannot learn from the annotations or output schema alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and every clause carries real information, but the prose is a run-on semicolon chain that roughly doubles the length needed. The conditional "with sections omitted, ... adds examples to the defaults" clause is restated in near-identical form for each example parameter, and the control-character rejection rule largely repeats the schema, so there is avoidable redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with an output schema, this is nearly complete: default sections, outline mode, example paging, deferred IDs, and failure modes are all covered. The only loose end is that it never says how to retrieve items reported in deferredIds (re-call with those IDs), and it gives no guidance on ordering or cost for large ID arrays.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns more by explaining the non-obvious interplay between sections and the example* trio (setting any to non-default while omitting sections adds examples after the defaults; explicit sections without examples ignore the example params). The empty-array-means-outline convention and the note that categories/groupings are organizational rather than root causes add genuine meaning beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and resource ("Retrieve CWE weaknesses, categories, or groupings by ID") plus accepted ID formats (CWE-79, CWE79, 79). It also draws a scope boundary by stating that a view or a CAPEC ID lands in notFound, which implicitly points at the sibling get_view/get_attack_pattern tools without naming them, so differentiation is present but indirect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It spells out operational conditions: the first 20 distinct positions processed and the rest listed in deferredIds, per-item notFound versus whole-call rejection, empty sections array for an outline, and exactly when exampleLanguage/exampleOffset/exampleLimit are honored versus ignored. It stops short of saying when to reach for this tool versus cwe_search_weaknesses (ID lookup vs keyword search), leaving that routing implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mitre-cwe-mcp-server toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources