Skip to main content
Glama
Alig1493

NVD MCP Server

by Alig1493
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

Server Quality Checklist

83%
Profile completionA complete profile improves this server's visibility in search results.

  • Latest release: v1.0.0

  • Disambiguation5/5

    The two tools are clearly distinct: one searches CVE records and the other searches change history. An agent can easily differentiate between them based on their descriptions.

    Naming Consistency5/5

    Both tools follow a consistent verb_noun pattern using snake_case: search_cve_history and search_cves. The naming is predictable and clear.

    Tool Count3/5

    With only two tools, the server feels minimal for a database like NVD. While the tools cover basic search functionality, the count is on the low side for the apparent scope.

    Completeness4/5

    The two tools cover searching for CVEs and their change history, which are core operations. However, lacking separate tools for CPE lookup or vulnerability statistics is a minor gap.

  • Average 4.1/5 across 2 of 2 tools scored.

    See the Tool Scores section below for per-tool breakdowns.

    • No community issues in the last 6 months
    • 0 commits in the last 12 weeks
    • Last stable release on
    • No critical vulnerability alerts
    • No high-severity vulnerability alerts
    • No code scanning findings
    • CI is failing

  • This repository is licensed under GPL 3.0.

  • This repository includes a README.md file.

  • No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.

    Tip: use the "Try in Browser" feature on the server page to seed initial usage.

  • This repository includes a glama.json configuration file.

  • If you are the author, simply .

    If the server belongs to an organization, first add glama.json to the root of your repository:

    {
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}

    Then . Browse examples.

  • View related servers

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

  • Behavior4/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations are provided, so the description carries the full burden. It discloses performance implications (e.g., slow queries without date ranges), mutual exclusivity constraints, and the return format (JSON with pagination). It does not cover authentication or rate limits, but for a search tool, the transparency is good.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is well-structured: an introductory sentence, return value summary, performance guidance, and mutual exclusivity rules. Every sentence serves a purpose and is front-loaded. Despite being relatively long, there is no redundancy or fluff.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    The description covers the main behavior (search, pagination, key fields), but lacks details on error handling, rate limits, or authentication. Given the complexity of the tool (many parameters, nested schemas), the description is nearly complete, especially with the output schema existing.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters4/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema description coverage is 100%, so parameters are already well-documented. The description adds value beyond the schema by summarizing performance guidelines and mutually exclusive groups, which helps agents combine parameters correctly. The 'Mutually exclusive groups' section is particularly useful for avoiding invalid combinations.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states the tool's purpose: 'Search the National Vulnerability Database (NVD) for CVEs matching the given filters.' It specifies the verb (search), resource (CVEs), and source (NVD). The return structure is also described, making the purpose unambiguous.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    While the description provides performance guidance and lists mutually exclusive parameter groups, it does not mention when to use this tool over its sibling 'search_cve_history'. There is no explicit guidance on tool selection or when not to use this tool, which is a significant gap given the sibling exists.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior4/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations exist, so the description carries the burden. It states returns JSON with pagination and change events, and notes performance characteristics (slower than CVE API). However, it does not detail output structure or mention potential timeouts beyond the given guidance.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness4/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Reasonably concise with three paragraphs: purpose, return info, then performance guidance. Information is front-loaded, though some details (like max range) appear both in description and schema. Could be slightly tighter.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given the complexity (nested input, output schema exists), the description covers purpose, return type, and performance. It lacks explanation of pagination mechanics or output field details, but the output schema compensates. Sufficient for an agent to use effectively.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema description coverage is 100% with detailed comments for each parameter. The tool description does not add extra semantic value beyond the schema; baseline 3 is appropriate as the schema already provides rich information.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose4/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states 'Search the NVD CVE Change History API for changes made to CVE records.' It specifies the resource (CVE change history) and action (search), though it does not explicitly distinguish from the sibling tool 'search_cves' beyond a performance hint.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines5/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    Provides explicit performance guidance: set results_per_page to 2-5, narrow date window to 7 days or less, avoid event_name without date range, and use cve_id for fastest queries. Also notes maximum 120-day range, giving clear when-to and how-to-use instructions.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

  • Confirm that the MCP server is working as expected.
  • Confirm that there are no obvious security issues.
  • Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

nvd-mcp-server MCP server

Copy to your README.md:

Score Badge

nvd-mcp-server MCP server

Copy to your README.md:

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Alig1493/nvd-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server