Schema | NVD MCP Server

NVD MCP Server

Overview Schema Source Related Servers Discussions Admin

Server Configuration

Describes the environment variables required to run the server.

Name	Required	Description	Default
`NVD_API_KEY`	Yes	Your NVD API key
`NVD_CVE_URL`	No	NVD CVE endpoint	https://services.nvd.nist.gov/rest/json/cves/2.0
`TOTAL_TIMEOUT`	No	Per-request HTTP timeout in seconds	60.0
`RETRY_MAX_DURATION`	No	Total retry budget in seconds	120
`NVD_CVE_HISTORY_URL`	No	NVD history endpoint	https://services.nvd.nist.gov/rest/json/cvehistory/2.0

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

Capability	Details
`tools`	{ "listChanged": true }
`logging`	{}
`prompts`	{ "listChanged": false }
`resources`	{ "subscribe": false, "listChanged": false }
`extensions`	{ "io.modelcontextprotocol/ui": {} }
`experimental`	{}

Tools

Functions exposed to the LLM to take actions

Name	Description
search_cvesA	Search the National Vulnerability Database (NVD) for CVEs matching the given filters. Returns a JSON string with pagination info and a list of matching CVEs, each containing: id, published date, status, English description, CVSS score, CWE weaknesses, top 5 references, and CISA KEV data if applicable. Performance guidance: Keep results_per_page at 5–10 to avoid slow responses. When filtering by date, limit the window to 30 days or less. Broad severity or keyword queries without a date range can be slow; add pub_start_date / pub_end_date or last_mod_start_date / last_mod_end_date to speed them up. Mutually exclusive groups (enforced by validation): cvssV2Metrics / cvssV3Metrics / cvssV4Metrics: use at most one cvssV2Severity / cvssV3Severity / cvssV4Severity: use at most one isVulnerable requires cpeName and excludes virtualMatchString version range params (versionStart/End) require virtualMatchString
search_cve_historyA	Search the NVD CVE Change History API for changes made to CVE records. Returns a JSON string with pagination info and a list of change events, each containing the CVE ID, event type, source, timestamp, and change details. Performance guidance — the history API is significantly slower than the CVE API: Always set results_per_page to 2–5. Narrow the date window to 7 days or less when using change_start_date / change_end_date. The maximum allowable range is 120 consecutive days. Avoid querying by event_name alone without a date range — it scans the entire history database and will time out. Combine event_name with a date range. For a specific CVE use cve_id; that is the fastest query.

Name

Description

search_cvesA

Search the National Vulnerability Database (NVD) for CVEs matching the given filters.

Returns a JSON string with pagination info and a list of matching CVEs, each containing: id, published date, status, English description, CVSS score, CWE weaknesses, top 5 references, and CISA KEV data if applicable.

Performance guidance:

Keep results_per_page at 5–10 to avoid slow responses.
When filtering by date, limit the window to 30 days or less.
Broad severity or keyword queries without a date range can be slow; add pub_start_date / pub_end_date or last_mod_start_date / last_mod_end_date to speed them up.

Mutually exclusive groups (enforced by validation):

cvssV2Metrics / cvssV3Metrics / cvssV4Metrics: use at most one
cvssV2Severity / cvssV3Severity / cvssV4Severity: use at most one
isVulnerable requires cpeName and excludes virtualMatchString
version range params (versionStart/End) require virtualMatchString

search_cve_historyA

Search the NVD CVE Change History API for changes made to CVE records.

Returns a JSON string with pagination info and a list of change events, each containing the CVE ID, event type, source, timestamp, and change details.

Performance guidance — the history API is significantly slower than the CVE API:

Always set results_per_page to 2–5.
Narrow the date window to 7 days or less when using change_start_date / change_end_date. The maximum allowable range is 120 consecutive days.
Avoid querying by event_name alone without a date range — it scans the entire history database and will time out. Combine event_name with a date range.
For a specific CVE use cve_id; that is the fastest query.

Prompts

Interactive templates invoked by user choice

Name	Description
No prompts

Resources

Contextual data attached and managed by the client

Name	Description
No resources

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.2/5.0

Scored 2026-05-26 21:10 across 2 tools

Disambiguation5/5

The two tools are clearly distinct: one searches CVE records and the other searches change history. An agent can easily differentiate between them based on their descriptions.

Naming Consistency5/5

Both tools follow a consistent verb_noun pattern using snake_case: search_cve_history and search_cves. The naming is predictable and clear.

Tool Count3/5

With only two tools, the server feels minimal for a database like NVD. While the tools cover basic search functionality, the count is on the low side for the apparent scope.

Completeness4/5

The two tools cover searching for CVEs and their change history, which are core operations. However, lacking separate tools for CPE lookup or vulnerability statistics is a minor gap.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers