nist-nvd-mcp-server

Search CVEs

nvd_search_cves

Read-only

Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID). Blank string filters are omitted with a notice; nonblank strings are trimmed.

Input Schema

Name	Required	Description	Default
`cweId`	No	Filter by CWE weakness ID (e.g., "CWE-79", "NVD-CWE-Other").
`limit`	No	Maximum number of results to return (default 20; values above 2000 are clamped unless NVD_CLAMP_LIMITS is false).
`offset`	No	Zero-based page offset for pagination.
`kevOnly`	No	When true, filters results to CVEs in the CISA Known Exploited Vulnerabilities catalog.
`keyword`	No	Full-text search across CVE descriptions (AND-semantics across words).
`pubDays`	No	CVEs published in the last N days (max 120; values over 120 are clamped). Mutually exclusive with pubStartDate/pubEndDate.
`severity`	No	Filter to CVEs in exactly this CVSS severity band — NVD matches the one band, not a floor. Covering several bands (e.g. HIGH and CRITICAL) takes one call per band.
`noRejected`	No	When true (default), excludes CVEs with REJECT/Rejected status.
`pubEndDate`	No	ISO 8601 datetime for publication range end. Both pubStartDate and pubEndDate required together.
`exactPhrase`	No	When true, keyword matches as an exact phrase rather than ANDing its words independently. Requires keyword.
`lastModDays`	No	CVEs last modified in the last N days (max 120; values over 120 are clamped). Mutually exclusive with lastModStartDate/lastModEndDate.
`pubStartDate`	No	ISO 8601 datetime for publication range start. Both pubStartDate and pubEndDate required together. Mutually exclusive with pubDays.
`lastModEndDate`	No	ISO 8601 datetime for last-modified range end. Both required together.
`severityVersion`	No	CVSS version to use for the severity filter. Default: v3 (maps to cvssV3Severity).	v3
`lastModStartDate`	No	ISO 8601 datetime for last-modified range start. Both required together. Mutually exclusive with lastModDays.

Output Schema

Name	Required	Description
`cves`	No	Matching CVE summaries. Call nvd_get_cve for full detail on specific IDs.
`error`	No	Present when the call failed. Absent on success.
`notice`	No	Ignored blank filters and paging guidance: distinguishes no matches, an exhausted offset, and an inconsistent empty upstream page; on a partial page, names the next offset.
`offset`	No	Page offset used in this query.
`returned`	No	Number of CVEs returned in this response.
`totalCount`	No	Total matching CVEs in NVD before pagination.
`datesClamped`	No	Entries for any pubDays/lastModDays values that exceeded 120 and were auto-clamped. Absent when no clamping occurred.
`effectiveLimit`	No	Page size or ID count used after clamping.
`filtersApplied`	No	The non-default filters this query actually applied — the ones that can account for an empty or unexpectedly narrow result set. Absent when the query ran unfiltered, which is itself the answer when a result set is unexpectedly broad.
`requestedLimit`	No	Requested page size or ID count before clamping.

Schema Changelog

Changes observed during successful MCP inspections.

Changed11 schema fields changedOct 27, 2026

changedInput schema / properties / limit / description

Previous value: -"Maximum number of results to return (default 20, max 2000)."New value: +"Maximum number of results to return (default 20; values above 2000 are clamped unless NVD_CLAMP_LIMITS is false)."

changedInput schema / properties / limit / maximum

Previous value: -2000New value: +9007199254740991

addedOutput schema / properties / effectiveLimit

Added value: +{
+  "description": "Page size or ID count used after clamping.",
+  "type": "number"
+}

changedOutput schema / properties / error / properties / data / properties / reason / description

Previous value: -"Machine-readable failure mode. Declared by this tool: `exact_phrase_without_keyword`: exactPhrase was set without a keyword. It selects how keyword matches and has nothing to modify on its own; NVD rejects the underlying flag on the same grounds. `mutually_exclusive_params`: Both pubDays and pubStartDate/pubEndDate provided, or both lastModDays and lastModStartDate/lastModEndDate. `missing_date_pair`: Only one of pubStartDate/pubEndDate (or lastModStartDate/lastModEndDate) was provided — NVD requires both. `date_range_inverted`: The end date is before the start date. `date_range_exceeds_max`: Explicit pubStartDate/pubEndDate or lastModStartDate/lastModEndDate span more than 120 days. `invalid_date_format`: A date string provided for pubStartDate, pubEndDate, lastModStartDate, or lastModEndDate is not a valid ISO 8601 datetime. `invalid_severity_for_version`: severity=\"CRITICAL\" was specified with severityVersion=\"v2\" — CVSS v2 has no CRITICAL tier. `rate_limited`: NVD returned HTTP 403 indicating the rate limit was exceeded. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `nvd_invalid_response`: NVD returned an unusable response. `nvd_request_blocked`: The NVD security layer blocked the request. `nvd_request_rejected`: NVD rejected a search parameter. `exact_phrase_without_keyword`: exactPhrase was set without a keyword. It selects how keyword matches and has nothing to modify on its own; NVD rejects the underlying flag on the same grounds. `mutually_exclusive_params`: Both pubDays and pubStartDate/pubEndDate provided, or both lastModDays and lastModStartDate/lastModEndDate. `missing_date_pair`: Only one of pubStartDate/pubEndDate (or lastModStartDate/lastModEndDate) was provided — NVD requires both. `date_range_inverted`: The end date is before the start date. `date_range_exceeds_max`: Explicit pubStartDate/pubEndDate or lastModStartDate/lastModEndDate span more than 120 days. `invalid_date_format`: A date string provided for pubStartDate, pubEndDate, lastModStartDate, or lastModEndDate is not a valid ISO 8601 datetime. `invalid_severity_for_version`: severity=\"CRITICAL\" was specified with severityVersion=\"v2\" — CVSS v2 has no CRITICAL tier. `rate_limited`: NVD explicitly reported that the rate limit was exceeded. Other values are possible when a failure originates below the handler."

changedOutput schema / properties / error / properties / data / properties / reason / examples

Previous value: -[
-  "exact_phrase_without_keyword",
-  "mutually_exclusive_params",
-  "missing_date_pair",
-  "date_range_inverted",
-  "date_range_exceeds_max",
-  "invalid_date_format",
-  "invalid_severity_for_version",
-  "rate_limited"
-]New value: +[
+  "nvd_invalid_response",
+  "nvd_request_blocked",
+  "nvd_request_rejected",
+  "exact_phrase_without_keyword",
+  "mutually_exclusive_params",
+  "missing_date_pair",
+  "date_range_inverted",
+  "date_range_exceeds_max",
+  "invalid_date_format",
+  "invalid_severity_for_version",
+  "rate_limited"
+]

addedOutput schema / properties / filtersApplied / properties / lastModEndDate

Added value: +{
+  "description": "Effective last-modified range end sent to NVD.",
+  "type": "string"
+}

addedOutput schema / properties / filtersApplied / properties / lastModStartDate

Added value: +{
+  "description": "Effective last-modified range start sent to NVD.",
+  "type": "string"
+}

addedOutput schema / properties / filtersApplied / properties / pubEndDate

Added value: +{
+  "description": "Effective publication range end sent to NVD.",
+  "type": "string"
+}

addedOutput schema / properties / filtersApplied / properties / pubStartDate

Added value: +{
+  "description": "Effective publication range start sent to NVD.",
+  "type": "string"
+}

changedOutput schema / properties / notice / description

Previous value: -"Guidance when no CVEs were returned — distinguishes a query nothing matched from an offset past the result set from an empty page NVD returned inside a range it says has matches — or, on a partial page, the offset that reaches the next one."New value: +"Ignored blank filters and paging guidance: distinguishes no matches, an exhausted offset, and an inconsistent empty upstream page; on a partial page, names the next offset."

addedOutput schema / properties / requestedLimit

Added value: +{
+  "description": "Requested page size or ID count before clamping.",
+  "type": "number"
+}

First observedSep 20, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the readOnly/openWorld annotations by disclosing clamping of pubDays/lastModDays at 120 days, reporting of clamping in response enrichment, blank-string filters being dropped with a notice, and trimming of nonblank strings. These are non-obvious behaviors an agent cannot infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the capability and purpose, then progressively adds behavioral detail with no filler sentences. It is somewhat dense across six sentences, but each carries distinct information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter read-only search with a full output schema, everything needed to call it correctly is present: default ordering, filter-omission behavior, clamping limits, and the handoff to nvd_get_cve. Return-value detail is correctly deferred to the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real semantics beyond the schema: pubDays/lastModDays expand into date pairs and interact with the explicit start/end parameters, and blank strings are silently omitted. It does not clarify severity band semantics (one band not a floor) or mutual exclusions, which remain schema-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search CVEs') plus the exact filter dimensions it supports (keyword, severity, CWE, date range, KEV). It explicitly positions itself against the sibling nvd_get_cve, so an agent can distinguish discovery from detail retrieval without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names itself the 'primary discovery tool' for surveillance and triage and routes detail lookups to nvd_get_cve. It also gives explicit fallback behavior when no filter is supplied ('returns CVEs in default NVD index order, oldest first'), covering the when-not case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nist-nvd-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.