nist-nvd-mcp-server

Search CPE Dictionary

nvd_search_cpes

Read-only

Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http_server:2.4.51:::::::*) and must match exactly to audit the right product.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "nvd_search_cpes"
  }
}

Input Schema

Name	Required	Description
`limit`	No	Maximum number of CPE entries to return (default 20; values above 10000 are clamped unless NVD_CLAMP_LIMITS is false).
`offset`	No	Zero-based page offset for pagination. When totalCount exceeds offset + returned, raise offset to reach the rest — a vendor-level keyword has nothing left to narrow toward.
`keyword`	No	Product name or vendor keyword (e.g., "apache http server", "openssl", "nginx"). At least one of keyword or cpeMatchString is required.
`cpeMatchString`	No	Partial CPEv2.3 pattern (e.g., "cpe:2.3:a:apache:http_server"). At least one of keyword or cpeMatchString is required.

Output Schema

Name	Required	Description
`cpes`	No	Matching CPE dictionary entries.
`error`	No	Present when the call failed. Absent on success.
`notice`	No	Guidance when no CPEs matched, the offset ran past the result set, NVD returned an empty page inside a range it says has matches, or entries remain beyond this page.
`offset`	No	Page offset used in this query.
`returned`	No	Number of entries returned in this response.
`totalCount`	No	Total matching CPE entries before the limit was applied.
`effectiveLimit`	No	Page size or ID count used after clamping.
`requestedLimit`	No	Requested page size or ID count before clamping.

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedOct 27, 2026

changedInput schema / properties / limit / description

Previous value: -"Maximum number of CPE entries to return (default 20, max 10000)."New value: +"Maximum number of CPE entries to return (default 20; values above 10000 are clamped unless NVD_CLAMP_LIMITS is false)."

changedInput schema / properties / limit / maximum

Previous value: -10000New value: +9007199254740991

addedOutput schema / properties / effectiveLimit

Added value: +{
+  "description": "Page size or ID count used after clamping.",
+  "type": "number"
+}

changedOutput schema / properties / error / properties / data / properties / reason / description

Previous value: -"Machine-readable failure mode. Declared by this tool: `missing_search_input`: Neither keyword nor cpeMatchString was provided. `invalid_cpe_format`: The cpeMatchString does not start with \"cpe:2.3:\", or NVD rejected it as a malformed CPE parameter. A merely truncated prefix is a legitimate partial match and returns an empty page instead. `rate_limited`: NVD returned HTTP 403 indicating the rate limit was exceeded. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `nvd_invalid_response`: NVD returned an unusable response. `nvd_request_blocked`: The NVD security layer blocked the request. `missing_search_input`: Neither keyword nor cpeMatchString was provided. `invalid_cpe_format`: The cpeMatchString does not start with \"cpe:2.3:\", or NVD rejected it as a malformed CPE parameter. A merely truncated prefix is a legitimate partial match and returns an empty page instead. `rate_limited`: NVD explicitly reported that the rate limit was exceeded. Other values are possible when a failure originates below the handler."

changedOutput schema / properties / error / properties / data / properties / reason / examples

Previous value: -[
-  "missing_search_input",
-  "invalid_cpe_format",
-  "rate_limited"
-]New value: +[
+  "nvd_invalid_response",
+  "nvd_request_blocked",
+  "missing_search_input",
+  "invalid_cpe_format",
+  "rate_limited"
+]

addedOutput schema / properties / requestedLimit

Added value: +{
+  "description": "Requested page size or ID count before clamping.",
+  "type": "number"
+}

First observedSep 20, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint=false, so the safety profile is covered; the description adds that deprecation status is surfaced and that results are identifiers requiring exact matching. It omits rate limiting and pagination behavior, though the schema covers pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: what it does, what it returns, then the workflow rationale. Front-loaded with the search purpose and zero redundant restatement of the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema, full parameter documentation, and safety annotations already present, the only gap left for the description is cross-tool workflow — which it supplies. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so keyword, cpeMatchString, limit, and offset are already fully documented in the schema. The description reinforces how CPE strings look and why they matter but adds no format or syntax detail beyond the schema's own examples, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and resource (NVD CPE dictionary) and explicitly names the fields returned: CPE names, titles, deprecation status. It also distinguishes the tool from the sibling nvd_audit_cpe by framing this as the resolution step that precedes auditing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit sequencing guidance — 'Use before nvd_audit_cpe to resolve the correct CPE name' — and explains why the resolution step is necessary (CPE strings must match exactly). This is exactly the when-to-use framing an agent needs before picking among four siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nist-nvd-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.