cve-lookup-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Optional NVD API key for higher rate limits (50 req/30s instead of 5 req/30s). Request from https://nvd.nist.gov/developers/request-an-api-key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lookup_cveA | Look up a specific CVE by ID. Returns CVSS score, severity, description, affected products, EPSS exploitation probability, and references. Data sourced live from NVD and FIRST EPSS. |
| search_cvesA | Search NVD for CVEs matching a keyword. Useful for finding vulnerabilities in a specific product or technology. Results are sorted by CVSS score descending. |
| check_product_cvesA | Find HIGH and CRITICAL CVEs for a specific vendor/product. Ideal for assessing a detected software version during a security review or penetration test. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: check_product_cves for product-specific high/critical CVEs, lookup_cve for a specific ID, and search_cves for keyword searches. No overlap in functionality.
All tool names follow a consistent verb_noun pattern in snake_case (check_product_cves, lookup_cve, search_cves), making it easy to predict their purpose.
With 3 tools, the set is well-scoped for a CVE lookup server. Each tool serves a distinct and essential function without unnecessary redundancy.
Covers the core use cases: keyword search, ID lookup, and product-based filtering. Missing a time-based or trending CVE lookup, but the essential workflows are complete for most security assessments.