# cve-lookup-mcp

An MCP server that gives AI assistants live access to CVE data from the [National Vulnerability Database (NVD)](https://nvd.nist.gov/) and [FIRST EPSS](https://www.first.org/epss/) — no API key required.

Built for use with [Claude Code](https://claude.ai/code) and any other [Model Context Protocol](https://modelcontextprotocol.io/) compatible client.

---

## Tools

| Tool | Description |
|------|-------------|
| `lookup_cve` | Full details for a CVE — CVSS score, description, affected products, EPSS exploitation probability, references |
| `search_cves` | Search NVD by keyword with optional severity and year filters |
| `check_product_cves` | Find all HIGH/CRITICAL CVEs for a vendor/product (useful during version fingerprinting) |

### Example prompts

```
Look up CVE-2022-41352
```
```
Search for critical Zimbra RCE vulnerabilities from 2022
```
```
Check CVEs for apache struts
```

---

## Installation

### Option 1 — pipx (recommended)

```bash
pipx install cve-lookup-mcp
```

### Option 2 — pip

```bash
pip install cve-lookup-mcp
```

### Option 3 — run from source

```bash
git clone https://github.com/Aashish-32/cve-lookup-mcp
cd cve-lookup-mcp
pip install -e .
```

---

## Configuration

Add to your `~/.claude.json` (Claude Code) or equivalent MCP client config:

```json
{
  "mcpServers": {
    "cve-lookup": {
      "command": "cve-lookup-mcp",
      "args": []
    }
  }
}
```

If installed from source, point directly at the script:

```json
{
  "mcpServers": {
    "cve-lookup": {
      "command": "python3",
      "args": ["/path/to/cve-lookup-mcp/src/cve_lookup_mcp/server.py"]
    }
  }
}
```

Restart your MCP client after adding the config.

---

## Data sources

| Source | What it provides | Rate limit |
|--------|-----------------|------------|
| [NVD API v2](https://nvd.nist.gov/developers/vulnerabilities) | CVE details, CVSS scores, affected products | ~5 req/30s (no key), 50 req/30s (with key) |
| [FIRST EPSS API](https://www.first.org/epss/api) | Exploitation probability score | None |

### NVD API key (optional)

Without a key, NVD allows roughly 5 requests per 30 seconds. For heavier use, [request a free API key from NVD](https://nvd.nist.gov/developers/request-an-api-key) and set it as an environment variable:

```json
{
  "mcpServers": {
    "cve-lookup": {
      "command": "cve-lookup-mcp",
      "env": {
        "NVD_API_KEY": "your-key-here"
      }
    }
  }
}
```

---

## Development

```bash
git clone https://github.com/Aashish-32/cve-lookup-mcp
cd cve-lookup-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
```

Run the server manually (stdio mode):

```bash
cve-lookup-mcp
```

Test with a raw JSON-RPC call:

```bash
echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1"}}}' \
  | cve-lookup-mcp
```

---

## License

MIT