Skip to main content
Glama
Sign In
cve-lookup-mcp

cve-lookup-mcp

by Aashish-32
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

cve-lookup-mcp

An MCP server that gives AI assistants live access to CVE data from the National Vulnerability Database (NVD) and FIRST EPSS — no API key required.

Built for use with Claude Code and any other Model Context Protocol compatible client.

Tools

Tool

Description

lookup_cve

Full details for a CVE — CVSS score, description, affected products, EPSS exploitation probability, references

search_cves

Search NVD by keyword with optional severity and year filters

check_product_cves

Find all HIGH/CRITICAL CVEs for a vendor/product (useful during version fingerprinting)

Example prompts

Look up CVE-2022-41352
Search for critical Zimbra RCE vulnerabilities from 2022
Check CVEs for apache struts

Related MCP server: vuln-intel-mcp

Installation

Option 1 — pipx (recommended)

pipx install cve-lookup-mcp

Option 2 — pip

pip install cve-lookup-mcp

Option 3 — run from source

git clone https://github.com/Aashish-32/cve-lookup-mcp
cd cve-lookup-mcp
pip install -e .

Configuration

Add to your ~/.claude.json (Claude Code) or equivalent MCP client config:

{
  "mcpServers": {
    "cve-lookup": {
      "command": "cve-lookup-mcp",
      "args": []
    }
  }
}

If installed from source, point directly at the script:

{
  "mcpServers": {
    "cve-lookup": {
      "command": "python3",
      "args": ["/path/to/cve-lookup-mcp/src/cve_lookup_mcp/server.py"]
    }
  }
}

Restart your MCP client after adding the config.

Data sources

Source

What it provides

Rate limit

NVD API v2

CVE details, CVSS scores, affected products

~5 req/30s (no key), 50 req/30s (with key)

FIRST EPSS API

Exploitation probability score

None

NVD API key (optional)

Without a key, NVD allows roughly 5 requests per 30 seconds. For heavier use, request a free API key from NVD and set it as an environment variable:

{
  "mcpServers": {
    "cve-lookup": {
      "command": "cve-lookup-mcp",
      "env": {
        "NVD_API_KEY": "your-key-here"
      }
    }
  }
}

Development

git clone https://github.com/Aashish-32/cve-lookup-mcp
cd cve-lookup-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

Run the server manually (stdio mode):

cve-lookup-mcp

Test with a raw JSON-RPC call:

echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1"}}}' \
  | cve-lookup-mcp

License

MIT

Available Tools

3 tools
check_product_cvesA

Find HIGH and CRITICAL CVEs for a specific vendor/product. Ideal for assessing a detected software version during a security review or penetration test.

Inputs: vendor (required), product.

lookup_cveA

Look up a specific CVE by ID. Returns CVSS score, severity, description, affected products, EPSS exploitation probability, and references. Data sourced live from NVD and FIRST EPSS.

Inputs: cve_id (required).

search_cvesA

Search NVD for CVEs matching a keyword. Useful for finding vulnerabilities in a specific product or technology. Results are sorted by CVSS score descending.

Inputs: keyword (required), severity, year.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.1/5.0

    Scored across 3 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose: check_product_cves for product-specific high/critical CVEs, lookup_cve for a specific ID, and search_cves for keyword searches. No overlap in functionality.

    Naming Consistency5/5

    All tool names follow a consistent verb_noun pattern in snake_case (check_product_cves, lookup_cve, search_cves), making it easy to predict their purpose.

    Tool Count5/5

    With 3 tools, the set is well-scoped for a CVE lookup server. Each tool serves a distinct and essential function without unnecessary redundancy.

    Completeness4/5

    Covers the core use cases: keyword search, ID lookup, and product-based filtering. Missing a time-based or trending CVE lookup, but the essential workflows are complete for most security assessments.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • EPSS MCP Server

      kodamap
      F
      license
      Not graded
      quality
      D
      maintenance
      Provides EPSS scores, percentiles, and time series for CVEs, along with vulnerability details from the NVD API, enabling risk assessment through natural language.
      -

    • vuln-intel-mcp

      rohanrajnist
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
      1
      MIT

    • security-intel-mcp

      devsecforge
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides real-time vulnerability intelligence including CVE lookup, EPSS exploit probability, and CISA KEV status from free APIs, enabling AI assistants to prioritize CVEs by real-world risk.
      MIT

    • nvd

      pipeworx-io
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables querying CVE vulnerability data from the NIST National Vulnerability Database, including CVE lookup, product/version search via CPE filters, CVSS severity scores, and recent high-severity disclosures.
      351 npm
      MIT