mitre-cwe-mcp-server

Search CWE weaknesses

cwe_search_weaknesses

Read-onlyIdempotent

Search CWE weaknesses by all text tokens, exact platform or consequence vocabulary, abstraction, status, mapping usage, view membership, a recorded taxonomy mapping (taxonomy name or entry ID such as CERT C ARR30-C), or a CVE that MITRE cites as an observed example. A text token matches at a word start, never inside a word, so search a compound or negated form such as deserialization or untrusted as written; text never matches an entry ID or CVE. Omit filters to browse; categories are excluded. Each result carries MITRE’s mapping usage, which says whether the entry may be used to map a vulnerability, and, under a taxonomy or CVE filter, every mapping or observed example that matched. Results order by all tokens in the name or in one recorded alternate term such as XSS, then all in the description, then any other match, then numeric ID. Description previews contain the first sentence; use cwe_get_weakness for complete sections. Follow nextCursor for remaining matches.

Input Schema

TableJSON Schema

Name	Required	Description
`limit`	No	Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure.
`cursor`	No	Opaque continuation returned by this tool.
`filter`	No	All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS), never inside a word: search a compound or negated form as written, such as deserialization or untrusted. Blank means unset.
`status`	No	Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories carry matches nothing. Omission includes all statuses, including Deprecated.
`viewId`	No	CWE view ID such as CWE-1000 or 1000, from cwe_list_reference topic views; matches the weaknesses its recorded members reach within the view, or that its source filter selects for a filter-defined view. Blank means unset.
`language`	No	Exact platform language name or class; discover with cwe_list_reference topic platforms.
`technology`	No	Exact platform technology name or class; discover with cwe_list_reference topic platforms.
`abstraction`	No	Exact CWE abstraction level; blank means unset.
`mappingUsage`	No	Exact MITRE vulnerability mapping usage, such as Allowed or Allowed-with-Review; discover values with cwe_list_reference topic filter_values.
`taxonomyName`	No	Exact taxonomy name a weakness mapping records, such as CERT C Secure Coding or ISA/IEC 62443; discover values with cwe_list_reference topic filter_values. Matches any mapping in that taxonomy, including one without an entry ID.
`observedCveId`	No	CVE ID such as CVE-2021-44228, in any case; matches the weaknesses MITRE cites it on as an observed example, not other CVE-to-CWE assignments such as NVD’s. Blank means unset.
`taxonomyEntryId`	No	Entry ID a weakness taxonomy mapping records, such as ARR30-C or A1, in any case and with any whitespace runs; matches only the whole recorded ID. With taxonomyName, both must hold on the same mapping. Blank means unset.
`consequenceImpact`	No	Exact consequence impact; discover with cwe_list_reference topic filter_values.

Output Schema

TableJSON Schema

Name	Required	Description
`cap`	No	Effective page limit.
`error`	No	Present when the call failed. Absent on success.
`shown`	No	Items shown on this page.
`notice`	No	Empty-result or page-cap guidance.
`results`	No	Matching weakness page.
`truncated`	No	Whether a page omits remaining matches.
`pagination`	No	Local result pagination.
`provenance`	No	Loaded catalog provenance.
`totalCount`	No	Complete matching count before paging.
`appliedFilters`	No	Applied filters and defaults.

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, and open-world. The description adds substantive behavior beyond that: categories are excluded, results are ordered by match quality and then ID, result previews contain only the first sentence, and matching mapping/observed-example details appear under taxonomy or CVE filters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and searchability, then covers matching, exclusions, result shape, and pagination. It is dense and mostly earns its length, though several token-matching details duplicate the schema and could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 optional parameters, a fully documented schema, an output schema, and strong annotations, the description supplies everything needed: browse behavior, matching semantics, exclusions, result composition, ordering, and continuation via cursor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains nearly every parameter in detail, including token matching, taxonomy mapping conjunction, CVE exactness, and view semantics. The description adds little parameter meaning beyond the schema, so the high-coverage baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: search CWE weaknesses, then enumerates the dimensions by which it can search. This clearly distinguishes it from cwe_get_weakness (full sections) and cwe_search_attack_patterns (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to omit filters to browse, that categories are excluded, and that cwe_get_weakness should be used for complete sections. It also explains following nextCursor and how to discover filter values, giving clear alternatives and conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mitre-cwe-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.