mitre-cwe-mcp-server

Search CWE weaknesses

cwe_search_weaknesses

Read-onlyIdempotent

Search CWE weaknesses by all text tokens, exact platform or consequence vocabulary, abstraction, status, mapping usage, view membership, a recorded taxonomy mapping (taxonomy name or entry ID such as CERT C ARR30-C), or a CVE that MITRE cites as an observed example. Text tokens match at word starts or camelCase humps; tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted), with possible spelling coincidences. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens (hardcoded finds hard-coded). Text never matches an entry ID or CVE. When replacing one platform filter with its platform-independent class adds matches, a notice gives that repeat. Omit filters to browse; categories and groupings are excluded. Each result carries MITRE’s mapping usage, which says whether the entry may be used to map a vulnerability, and, under a taxonomy or CVE filter, every mapping or observed example that matched. Results order by all tokens in the name or in one recorded alternate term such as XSS, then all in the description, then any other match, then numeric ID. Description previews contain the first sentence; use cwe_get_weakness for complete sections. Follow nextCursor for remaining matches.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "cwe_search_weaknesses"
  }
}

Input Schema

Name	Required	Description
`limit`	No	Maximum page size; capped at 100 items with disclosure.
`cursor`	No	Opaque continuation returned by this tool.
`filter`	No	All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens (hardcoded finds hard-coded). Blank means unset.
`status`	No	Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories or groupings carry matches nothing. Omission includes all statuses, including Deprecated.
`viewId`	No	CWE view ID such as CWE-1000 or 1000, from cwe_list_reference topic views; matches the weaknesses its recorded members reach within the view, or that its source filter selects for a filter-defined view. Blank means unset.
`language`	No	Exact platform language name or class; discover with cwe_list_reference topic platforms.
`technology`	No	Exact platform technology name or class; discover with cwe_list_reference topic platforms.
`abstraction`	No	Exact CWE abstraction level; blank means unset.
`mappingUsage`	No	Exact MITRE vulnerability mapping usage, such as Allowed or Allowed-with-Review; discover values with cwe_list_reference topic filter_values.
`taxonomyName`	No	Exact taxonomy name a weakness mapping records, such as CERT C Secure Coding or ISA/IEC 62443; discover values with cwe_list_reference topic filter_values. Matches any mapping in that taxonomy, including one without an entry ID.
`observedCveId`	No	CVE ID such as CVE-2021-44228, in any case; matches the weaknesses MITRE cites it on as an observed example, not other CVE-to-CWE assignments such as NVD’s. Blank means unset.
`taxonomyEntryId`	No	Entry ID a weakness taxonomy mapping records, such as ARR30-C or A1, in any case and with any whitespace runs; matches only the whole recorded ID. With taxonomyName, both must hold on the same mapping. Blank means unset.
`consequenceImpact`	No	Exact consequence impact; discover with cwe_list_reference topic filter_values.

Output Schema

Name	Required	Description
`cap`	No	Effective page limit.
`error`	No	Present when the call failed. Absent on success.
`shown`	No	Items shown on this page.
`notice`	No	Catalog caveats, independent platform repeats, empty-result or page-cap guidance.
`results`	No	Matching weakness page.
`truncated`	No	Whether a page omits remaining matches.
`pagination`	No	Local result pagination.
`provenance`	No	Loaded catalog provenance.
`totalCount`	No	Complete matching count before paging.
`appliedFilters`	No	Applied filters and defaults.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedNov 11, 2026

changedInput schema / properties / filter / description

Previous value: -"All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. Other compounds such as deserialization must be searched as written. Blank means unset."New value: +"All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. An exact closed spelling also matches Unicode letter words joined by single ASCII hyphens (hardcoded finds hard-coded). Blank means unset."

changedInput schema / properties / limit / description

Previous value: -"Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."New value: +"Maximum page size; capped at 100 items with disclosure."

changedOutput schema / properties / notice / description

Previous value: -"Empty-result or page-cap guidance."New value: +"Catalog caveats, independent platform repeats, empty-result or page-cap guidance."

Changed2 schema fields changedNov 2, 2026

changedInput schema / properties / status / description

Previous value: -"Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories carry matches nothing. Omission includes all statuses, including Deprecated."New value: +"Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories or groupings carry matches nothing. Omission includes all statuses, including Deprecated."

addedOutput schema / properties / results / items / properties / matchedObservedExamples / items / properties / rationales

Added value: +{
+  "description": "Source observed-example rationale labels.",
+  "items": {
+    "description": "Source observed-example rationale labels.",
+    "type": "string"
+  },
+  "type": "array"
+}

Changed1 schema field changedOct 24, 2026

changedInput schema / properties / filter / description

Previous value: -"All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS), never inside a word: search a compound or negated form as written, such as deserialization or untrusted. Blank means unset."New value: +"All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. Other compounds such as deserialization must be searched as written. Blank means unset."

First observedOct 23, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnlyHint, idempotentHint, openWorldHint), and the description layers on non-obvious behavior: result ordering rules, first-sentence-only description previews, a notice when a platform filter is broadened to its platform-independent class, and per-result mapping-usage with matched mappings under taxonomy/CVE filters. What is missing is any statement about cost, latency, or result-volume expectations for a 13-filter search, which for an openWorld read would be useful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded, but the body is a dense run-on chain that duplicates the schema's token-matching rules nearly verbatim, which costs space without adding information. Sentences like "When replacing one platform filter with its platform-independent class adds matches, a notice gives that repeat" require re-reading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return shapes, yet it still covers ordering, preview truncation, pagination, and the broadening notice. For a 13-parameter, all-optional filter tool, nothing an agent needs in order to call it correctly is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is already 100% with 13 richly documented parameters, so the schema carries the load and the baseline is 3. The description adds a few genuinely new constraints ("Text never matches an entry ID or CVE", the platform-class broadening notice, and the guarantee that under taxonomy/CVE filters every matched mapping is returned), but most parameter prose is a restatement of the schema text rather than added meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ("Search CWE weaknesses") and immediately enumerates the filterable dimensions: text tokens, platform/consequence vocabulary, abstraction, status, mapping usage, view membership, taxonomy mapping, and observed CVE. It also explicitly names the sibling it is not ("use cwe_get_weakness for complete sections"), so the agent can separate search from retrieval without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the browse case ("Omit filters to browse"), an exclusion ("categories and groupings are excluded"), a routing alternative ("use cwe_get_weakness for complete sections"), and the continuation path ("Follow nextCursor for remaining matches"). These are the three decisions an agent actually has to make before calling it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mitre-cwe-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.