mitre-cwe-mcp-server

List CWE and CAPEC reference values

cwe_list_reference

Read-onlyIdempotent

List loaded CWE/CAPEC vocabulary, every CWE view, workflow guidance, or catalog versions and refresh health. Filter requires every whitespace-separated token in an item label, each at a word start or camelCase hump (script finds JavaScript). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens. Omit filter to browse. Platforms distinguishes example code languages from platform names and classes. Follow nextCursor for complete lists; limits above 100 are capped with disclosure.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "topic": "<topic>"
    },
    "name": "cwe_list_reference"
  }
}

Input Schema

Name	Required	Description
`limit`	No	Maximum page size; capped at 100 items with disclosure.
`topic`	Yes	views lists CWE view IDs; abstraction_levels explains CWE and CAPEC levels; mitigation_phases lists prevention phases; platforms lists platform dimensions and exampleLanguages; relationship_natures lists relation labels; filter_values lists statuses, consequence impacts, CWE mapping usage, CWE taxonomy names, severity, and likelihood; workflow explains navigation; versions reports catalog freshness and refresh health.
`cursor`	No	Opaque continuation returned by this tool.
`filter`	No	All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens. Blank means unset.

Output Schema

Name	Required	Description
`cap`	No	Effective page limit.
`error`	No	Present when the call failed. Absent on success.
`items`	No	Matching reference page.
`shown`	No	Reference items on this page.
`topic`	No	Requested topic.
`notice`	No	Applicable empty or cap disclosure.
`catalogs`	No	Both loaded catalog health records; versions only.
`truncated`	No	Whether the page limit omitted matching items.
`pagination`	No	Local result pagination.
`provenance`	No	Loaded catalog provenance.
`totalCount`	No	Matching reference items before paging.
`appliedFilters`	No	Applied filters and defaults.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedNov 11, 2026

changedInput schema / properties / filter / description

Previous value: -"All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset."New value: +"All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens. Blank means unset."

changedInput schema / properties / limit / description

Previous value: -"Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."New value: +"Maximum page size; capped at 100 items with disclosure."

Changed1 schema field changedOct 24, 2026

changedInput schema / properties / filter / description

Previous value: -"All-token case-insensitive label filter; each token matches at a word start or camelCase hump, never inside a word. Blank means unset."New value: +"All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset."

First observedOct 23, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and open-world, so the safety profile is covered. The description goes further by disclosing the limit cap with disclosure behavior, the cursor continuation contract, and precise filter-matching quirks (camelCase humps, un/mis prefix matches). It stops short of describing what the payload looks like, though an output schema exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the topic enumeration well, but the middle section reproduces the filter-matching rules almost verbatim from the schema description, which is redundant for an agent that already sees the schema. The hyphen and prefix sentences are dense and slow the reader for little added value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter listing tool with a full output schema, the description covers scope, topic meanings, paging, and filter behavior adequately. Only the per-topic return shapes are untouched, which the output schema already handles.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description exceeds it by explaining the filter's token and prefix matching rules and clarifying that the platforms topic separates example code languages from platform names — meaning that shapes how the parameter is actually used.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("List") over a concrete resource set: loaded CWE/CAPEC vocabulary, views, workflow guidance, and catalog versions/refresh health. An agent can tell this is the enumeration/reference tool rather than one of the get/search siblings, though no sibling is named to make the distinction explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Offers useful invocation hints — "Omit filter to browse" and "Follow nextCursor for complete lists" — which imply the paging pattern. However, it never says when to choose this over cwe_get_view or the search tools, nor what topic to pick for which question beyond the bare enumeration.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mitre-cwe-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.