Skip to main content
Glama
Alig1493

NVD MCP Server

by Alig1493
OverviewSchemaSourceRelated ServersScoreDiscussionsAdmin
Python
Hybrid

NVD MCP Server

NVD API Integration Tests

nvd-mcp-server MCP server

A Model Context Protocol (MCP) server that lets AI assistants like Claude, Cursor, and Gemini search the National Vulnerability Database (NVD) for security vulnerabilities and their change history — in plain English, no API knowledge required.

Ask your AI assistant things like:

  • "Find critical CVEs published this month"

  • "What vulnerabilities affect OpenSSL 3.0.0?"

  • "Look up Log4Shell"

  • "Show me the full change history for CVE-2021-44228"

  • "Which Log4Shell changes came from NVD analysts?"

How it works

sequenceDiagram
    actor User
    participant Agent as AI Assistant<br/>(Claude / Cursor / Gemini)
    participant MCP as NVD MCP Server
    participant NVD as NVD API<br/>(nvd.nist.gov)

    User->>Agent: "Find critical CVEs in Apache Log4j"
    Agent->>MCP: search_cves(keyword_search="Apache Log4j",<br/>cvss_v3_severity="CRITICAL")
    MCP->>NVD: GET /rest/json/cves/2.0<br/>?keywordSearch=Apache+Log4j<br/>&cvssV3Severity=CRITICAL<br/>&apiKey=...
    NVD-->>MCP: Raw vulnerability JSON
    MCP->>MCP: Validate & condense response
    MCP-->>Agent: id, description, CVSS score,<br/>CWEs, references, KEV status
    Agent-->>User: Formatted summary of matching CVEs

The server sits between your AI assistant and the NVD API. It:

  1. Receives natural-language-driven tool calls from the AI

  2. Translates them into authenticated NVD API requests

  3. Validates the raw response against strict data models

  4. Returns a clean, condensed result the AI can reason about

Related MCP server: VulnMCP

Tools

search_cves

Search the NVD CVE database with any combination of filters. Returns up to 10 CVEs per page, each with id, published date, status, description, CVSS score, CWEs, top 5 references, and CISA KEV data.

search_cve_history

Search the NVD CVE Change History API to see every modification made to a CVE record — description updates, CVSS score changes, CWE remaps, CPE configuration changes, KEV additions, and more. Returns a paginated list of change events with full before/after details.

Prerequisites

  • Python 3.11+

  • uv — fast Python package manager

  • An NVD API key (free, takes ~1 hour to receive)

Step 1 — Get an NVD API key

The NVD API is free and open, but an API key increases your rate limit from 5 requests/30 seconds to 50 requests/30 seconds.

  1. Go to https://nvd.nist.gov/developers/request-an-api-key

  2. Enter your email address and submit the form

  3. Check your email — you'll receive your key within an hour

  4. Copy the key, you'll need it in the next step

Step 2 — Install the server

git clone https://github.com/Alig1493/nvd-mcp-server.git
cd nvd-mcp-server
uv sync

Step 3 — Configure your API key

Create a .env file in the project root:

NVD_API_KEY=your-api-key-here

That's the only required setting. The NVD API URLs are pre-configured.

Step 4 — Connect to your AI assistant

The server supports two transports: local stdio (spawn a process) and remote Streamable HTTP (connect over a network).

Option A: Local Process Setup (stdio)

Great for single-user local workflows where your assistant spawns the server directly.

Claude Desktop

Open your Claude Desktop config file:

OS

Path

macOS

~/Library/Application Support/Claude/claude_desktop_config.json

Windows

%APPDATA%\Claude\claude_desktop_config.json

Add the following inside the "mcpServers" object:

{
  "mcpServers": {
    "nvd-mcp-server": {
      "type": "stdio",
      "command": "uv",
      "args": [
        "--directory", "/absolute/path/to/nvd-mcp-server",
        "run", "nvd-mcp-server",
        "--transport", "stdio"
      ],
      "env": {
        "NVD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Replace /absolute/path/to/nvd-mcp-server with your local repository root. Restart Claude Desktop.

Claude Code (CLI)

claude mcp add nvd-mcp-server \
  --command uv \
  --args "--directory /absolute/path/to/nvd-mcp-server run nvd-mcp-server --transport stdio" \
  --env NVD_API_KEY=your-api-key-here

Cursor

Open Cursor → Settings → MCP, then add:

  • Name: nvd-mcp-server

  • Type: command

  • Command: uv --directory /absolute/path/to/nvd-mcp-server run nvd-mcp-server --transport stdio

Option B: Cloud or Container Setup (Streamable HTTP)

Perfect for shared deployments or clients that connect over a network.

Start the server:

docker compose up --build -d

Connect your client using the /mcp endpoint:

{
  "mcpServers": {
    "nvd-mcp-server": {
      "type": "http",
      "url": "http://localhost:8000/mcp"
    }
  }
}

The NVD_API_KEY is read from your .env file automatically by Docker Compose.

Custom port:

docker run -d -p 9090:8000 --env-file .env nvd-mcp-server-app \
  nvd-mcp-server --transport http --host 0.0.0.0 --port 9090

Example prompts

Look up a specific CVE

"What is CVE-2021-44228?"

CVE-2021-44228 — Log4Shell
Published: 2021-12-10 | Status: Analyzed
CVSS: 10.0 CRITICAL (CVSSv3.1) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features do not protect against
attacker-controlled LDAP endpoints. An attacker who can control log messages
can execute arbitrary code loaded from a remote server.

CWEs: CWE-20, CWE-400, CWE-502, CWE-917
CISA KEV: Added 2021-12-10 · Due 2021-12-24

Find vulnerabilities for a product

"What are the critical vulnerabilities affecting OpenSSL 3.0.0?"

Search by keyword

"Find recent CVEs related to remote code execution in Windows"

"Show me SQL injection vulnerabilities from the last 6 months"

Filter by severity

"List high and critical CVEs published in January 2025"

"Find all CVEs in CISA's Known Exploited Vulnerabilities catalog from Q1 2023"

Track CVE changes over time

"Show me the change history for CVE-2021-44228"

"What Initial Analysis events happened in January 2024?"

"Show me all CVE CISA KEV updates from last month"

Paginate through results

"Show me the next page of results"

Every response includes a pagination_hint telling the assistant exactly how many results remain and how to fetch the next page.

Available filters (reference)

search_cves

Filter

What it does

Example value

cve_id

Look up a specific CVE

CVE-2021-44228

keyword_search

Search descriptions

"buffer overflow"

keyword_exact_match

Exact phrase match

true

cvss_v3_severity

Filter by CVSSv3 severity

CRITICAL, HIGH, MEDIUM, LOW

cvss_v2_severity

Filter by CVSSv2 severity

HIGH, MEDIUM, LOW

cvss_v3_metrics

Match a CVSSv3 vector string

AV:N/AC:L/PR:N/UI:N

cwe_id

Filter by weakness type

CWE-79, CWE-89

cpe_name

Filter by affected product

cpe:2.3:a:openssl:openssl:3.0.0:*:*:*:*:*:*:*

is_vulnerable

Only confirmed vulnerable configs

true (requires cpe_name)

virtual_match_string

Broad product match

cpe:2.3:o:linux:linux_kernel

pub_start_date / pub_end_date

Published date range

2024-01-01T00:00:00.000

last_mod_start_date / last_mod_end_date

Last modified date range

2025-01-01T00:00:00.000

kev_start_date / kev_end_date

CISA KEV addition date range

2023-01-01T00:00:00.000

has_kev

Only KEV catalog CVEs

true

no_rejected

Exclude rejected CVEs

true

cve_tag

Filter by tag

disputed, unsupported-when-assigned

start_index

Pagination offset

10, 20, ...

search_cve_history

Filter

What it does

Example value

cve_id

Full history for a specific CVE

CVE-2021-44228

event_name

Filter by change event type

Initial Analysis, CVE Rejected, CVE CISA KEV Update

change_start_date / change_end_date

Date range of changes (max 120 days)

2024-01-01T00:00:00.000

results_per_page

Results per page (max 5,000)

10

start_index

Pagination offset

10, 20, ...

Supported event names: CVE Received, Initial Analysis, Reanalysis, CVE Modified, Modified Analysis, CVE Translated, Vendor Comment, CVE Source Update, CPE Deprecation Remap, CWE Remap, Reference Tag Update, CVE Rejected, CVE Unrejected, CVE CISA KEV Update, Data Remediation, CVE Status Change

Notes

CVSSv2: NVD stopped generating CVSSv2 data on 2022-07-13. cvss_v2_severity and cvss_v2_metrics filters only match pre-2022 CVEs.

Date ranges: The maximum allowable range for any date filter is 120 consecutive days. Requests spanning a longer period will be rejected by the NVD API.

Rate limits: Without an API key you are limited to 5 requests per 30 seconds. Get a free key at https://nvd.nist.gov/developers/request-an-api-key.

Configuration options

Variable

Default

Description

NVD_API_KEY

(required)

Your NVD API key

NVD_CVE_URL

https://services.nvd.nist.gov/rest/json/cves/2.0

NVD CVE endpoint

NVD_CVE_HISTORY_URL

https://services.nvd.nist.gov/rest/json/cvehistory/2.0

NVD history endpoint

TOTAL_TIMEOUT

60.0

Per-request HTTP timeout in seconds

RETRY_MAX_DURATION

120

Total retry budget in seconds

Running the tests

End-to-end stdio tests (covers all search_cves and search_cve_history parameters):

uv run src/scripts/test_stdio_connection.py

HTTP smoke test (requires the Docker container to be running):

uv run src/scripts/test_http_connection.py
uv run src/scripts/test_http_connection.py --url http://localhost:9090/mcp

To run the tests in CI, add NVD_API_KEY as a repository secret in GitHub → Settings → Secrets → Actions.

Troubleshooting

The tool doesn't appear in my AI assistant Restart the application after editing the config file. Check that the path to the repo is absolute (not ~ or relative).

NVD_API_KEY validation error on startup The server requires an API key. Make sure NVD_API_KEY is set either in .env or in the "env" block of your MCP config.

Requests timing out The NVD API can be slow for broad queries. Try narrowing your search with additional filters. You can also increase the timeout: TOTAL_TIMEOUT=120.

Rate limit errors (HTTP 403) Without an API key you are limited to 5 requests per 30 seconds. Get a free key at https://nvd.nist.gov/developers/request-an-api-key.

Available Tools

2 tools
search_cve_historyA

Search the NVD CVE Change History API for changes made to CVE records.

Returns a JSON string with pagination info and a list of change events, each containing the CVE ID, event type, source, timestamp, and change details.

Performance guidance — the history API is significantly slower than the CVE API:

  • Always set results_per_page to 2–5.

  • Narrow the date window to 7 days or less when using change_start_date / change_end_date. The maximum allowable range is 120 consecutive days.

  • Avoid querying by event_name alone without a date range — it scans the entire history database and will time out. Combine event_name with a date range.

  • For a specific CVE use cve_id; that is the fastest query.

ParametersJSON Schema
NameRequiredDescriptionDefault
requestYesNVD CVE History API 2.0 request model. The CVE Change History API is used to easily retrieve information on changes made to a single CVE or a collection of CVE from the NVD. This API provides additional transparency to the work of the NVD, allowing users to easily monitor when and why vulnerabilities change. The NVD has existed in some form since 1999 and the fidelity of this information has changed several times over the decades. Earlier records may not contain the level of detail available with more recent CVE records. This is most apparent on CVE records prior to 2015.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the burden. It states returns JSON with pagination and change events, and notes performance characteristics (slower than CVE API). However, it does not detail output structure or mention potential timeouts beyond the given guidance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Reasonably concise with three paragraphs: purpose, return info, then performance guidance. Information is front-loaded, though some details (like max range) appear both in description and schema. Could be slightly tighter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (nested input, output schema exists), the description covers purpose, return type, and performance. It lacks explanation of pagination mechanics or output field details, but the output schema compensates. Sufficient for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with detailed comments for each parameter. The tool description does not add extra semantic value beyond the schema; baseline 3 is appropriate as the schema already provides rich information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search the NVD CVE Change History API for changes made to CVE records.' It specifies the resource (CVE change history) and action (search), though it does not explicitly distinguish from the sibling tool 'search_cves' beyond a performance hint.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit performance guidance: set results_per_page to 2-5, narrow date window to 7 days or less, avoid event_name without date range, and use cve_id for fastest queries. Also notes maximum 120-day range, giving clear when-to and how-to-use instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_cvesA

Search the National Vulnerability Database (NVD) for CVEs matching the given filters.

Returns a JSON string with pagination info and a list of matching CVEs, each containing: id, published date, status, English description, CVSS score, CWE weaknesses, top 5 references, and CISA KEV data if applicable.

Performance guidance:

  • Keep results_per_page at 5–10 to avoid slow responses.

  • When filtering by date, limit the window to 30 days or less.

  • Broad severity or keyword queries without a date range can be slow; add pub_start_date / pub_end_date or last_mod_start_date / last_mod_end_date to speed them up.

Mutually exclusive groups (enforced by validation):

  • cvssV2Metrics / cvssV3Metrics / cvssV4Metrics: use at most one

  • cvssV2Severity / cvssV3Severity / cvssV4Severity: use at most one

  • isVulnerable requires cpeName and excludes virtualMatchString

  • version range params (versionStart/End) require virtualMatchString

ParametersJSON Schema
NameRequiredDescriptionDefault
requestYesPydantic model for request params validation. Please note, as of July 2022, the NVD no longer generates new information for CVSS v2. Existing CVSS v2 information will remain in the database but the NVD will no longer actively populate CVSS v2 for new CVEs. NVD analysts will continue to use the reference information provided with the CVE and any publicly available information at the time of analysis to associate Reference Tags, information related to CVSS v3.1, CWE, and CPE Applicability statements. The CVE API returns four primary objects in the response body that are used for pagination: resultsPerPage, startIndex, totalResults, and vulnerabilities. totalResults indicates the total number of CVE records that match the request parameters. If the value of totalResults is greater than the value of resultsPerPage, there are more records than could be returned by a single API response and additional requests must update the startIndex to get the remaining records. The best, most efficient, practice for keeping up to date with the NVD is to use the date range parameters to request only the CVEs that have been modified since your last request. If filtering by `isVulnerable`, `cpeName` is required. Please note, `virtualMatchString` is not accepted in requests that use `isVulnerable`.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses performance implications (e.g., slow queries without date ranges), mutual exclusivity constraints, and the return format (JSON with pagination). It does not cover authentication or rate limits, but for a search tool, the transparency is good.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: an introductory sentence, return value summary, performance guidance, and mutual exclusivity rules. Every sentence serves a purpose and is front-loaded. Despite being relatively long, there is no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main behavior (search, pagination, key fields), but lacks details on error handling, rate limits, or authentication. Given the complexity of the tool (many parameters, nested schemas), the description is nearly complete, especially with the output schema existing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are already well-documented. The description adds value beyond the schema by summarizing performance guidelines and mutually exclusive groups, which helps agents combine parameters correctly. The 'Mutually exclusive groups' section is particularly useful for avoiding invalid combinations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Search the National Vulnerability Database (NVD) for CVEs matching the given filters.' It specifies the verb (search), resource (CVEs), and source (NVD). The return structure is also described, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description provides performance guidance and lists mutually exclusive parameter groups, it does not mention when to use this tool over its sibling 'search_cve_history'. There is no explicit guidance on tool selection or when not to use this tool, which is a significant gap given the sibling exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv1.0.0
    • First observedsearch_cve_history
    • First observedsearch_cves
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.2/5.0
Disambiguation5/5

The two tools are clearly distinct: one searches CVE records and the other searches change history. An agent can easily differentiate between them based on their descriptions.

Naming Consistency5/5

Both tools follow a consistent verb_noun pattern using snake_case: search_cve_history and search_cves. The naming is predictable and clear.

Tool Count3/5

With only two tools, the server feels minimal for a database like NVD. While the tools cover basic search functionality, the count is on the low side for the apparent scope.

Completeness4/5

The two tools cover searching for CVEs and their change history, which are core operations. However, lacking separate tools for CPE lookup or vulnerability statistics is a minor gap.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • mcp-nvd

    marcoeg
    A
    license
    B
    quality
    D
    maintenance
    A Model Context Protocol server implementation to query the NIST National Vulnerability Database (NVD) via its API.
    2
    15
    MIT

  • VulnMCP

    vulnerability-lookup
    A
    license
    A
    quality
    A
    maintenance
    An MCP server for vulnerability management that provides tools for automated severity and CWE classification using NLP models. It enables AI agents to query the Vulnerability Lookup API for detailed CVE information and search for security vulnerabilities across various sources.
    16
    42
    AGPL 3.0

  • CVE MCP Server

    mukul975
    A
    license
    A
    quality
    B
    maintenance
    This MCP server transforms Claude into a comprehensive security analyst by providing access to 27 security tools across 21 APIs for vulnerability intelligence. It enables users to query multiple sources like NVD, EPSS, CISA KEV, and threat intelligence platforms in parallel to get correlated security insights and risk assessments for CVEs.
    28
    1,452
    Apache 2.0

  • vuln-nist-mcp-server

    HaroldFinchIFT
    A
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server for querying the NIST National Vulnerability Database (NVD) API, enabling search and retrieval of CVE details, temporal context, and KEV catalog entries.
    15
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Alig1493/nvd-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server