Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@CVE Search MCP Server search for spring boot vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for CVE and vulnerability searching, optimized for PR review scenarios. Helps developers and security teams identify the latest CVEs and vulnerabilities — including those that postdate an LLM's training data.
8 tools covering CVE lookup, bulk scanning, keyword search, product search, recent CVEs, high-severity alerts, database stats, and detailed CVSS breakdowns
Multi-source: NVD, GitHub Advisory, OSV, CIRCL — searched concurrently and deduplicated
Smart normalization: "Node.js", "Spring Boot", "log4j2" all resolve correctly
Optional auth: GITHUB_TOKEN and NVD_API_KEY for higher rate limits
3 transports: stdio (default), SSE, Streamable HTTP
Related MCP server: Git-Fabric CVE
Python 3.10+
uv package manager
cd cve-search
uv syncuv sync --extra dev
uv run --extra dev pytest
uv run black src/
uv run ruff check src/Env Var | Default | Description |
| none | GitHub personal access token. Raises GitHub Advisory API rate limit from 60 to 5000 req/hr. |
| none | NVD API key. Raises rate limit from 5 to 50 req/30s. Get one at nvd.nist.gov. |
|
| HTTP request timeout in seconds. |
|
| Maximum results returned per tool call. |
# stdio (default — for Claude Desktop/IDE)
uv run python main.py
# SSE
uv run python main.py --transport sse --host 127.0.0.1 --port 8000
# Streamable HTTP (MCP spec 2025-06-18+)
uv run python main.py --transport streamable-http --host 127.0.0.1 --port 8000{
"mcpServers": {
"cve-search": {
"command": "uv",
"args": ["--directory", "/path/to/cve-search", "run", "python", "main.py"],
"env": {
"GITHUB_TOKEN": "your-token-here",
"NVD_API_KEY": "your-key-here"
}
}
}
}Tool | Description | Speed |
| Look up a specific CVE by ID (e.g. CVE-2021-44228) | Fast |
| Look up up to 20 CVE IDs in one call — ideal for scanning PR dependency lists | Fast |
| Search by vendor/product name (e.g. vendor="apache", product="struts") | Slow (10-15s) |
| Get CVEs from the last N days | Fast |
| Get CVSS ≥ 7.0 CVEs from the last N days | Fast |
| Smart multi-source keyword search (NVD + GitHub Advisory + OSV) | Fast |
| Database stats: total CVE count, last updated timestamp | Fast |
| Detailed CVSS v3/v4 breakdown for a CVE (base score, vector string, per-metric) | Fast |
bulk_cve_lookup(["CVE-2021-44228", "CVE-2023-44487", "CVE-2024-12345"])search_by_keyword("spring boot")check_high_severity_cves(7)cvss_score_lookup("CVE-2021-44228")cve-search/
├── src/mcp_server_cve_search/
│ ├── config.py # Config from env vars
│ ├── server.py # FastMCP app + transport dispatch
│ ├── tools/ # One module per tool group
│ │ ├── cve_lookup.py # search_cve_by_id, bulk_cve_lookup
│ │ ├── product_search.py
│ │ ├── recent_cves.py # get_recent_cves, check_high_severity_cves
│ │ ├── keyword_search.py
│ │ ├── stats.py # get_vulnerability_stats
│ │ └── cvss.py # cvss_score_lookup
│ ├── sources/ # One client per API
│ │ ├── circl.py # CIRCL CVE Search
│ │ ├── nvd.py # NVD/NIST (optional API key)
│ │ ├── github.py # GitHub Advisory (optional token)
│ │ └── osv.py # OSV (Google)
│ └── utils/
│ ├── severity.py # CVSS score helpers
│ ├── normalization.py # Keyword normalization + tech mappings
│ └── formatting.py # Summary/alert formatting
├── tests/
├── examples/
├── main.py
├── test_server.py # Manual live-API integration test
└── pyproject.tomlSource | URL | Notes |
CIRCL CVE Search | cve.circl.lu | Primary source; no auth required |
NVD (NIST) | nvd.nist.gov | Richest CVSS data; optional API key |
GitHub Advisory | github.com/advisories | Optional token for higher rate limits |
OSV (Google) | osv.dev | Open source vulnerability database |
MIT License
Look up multiple CVEs by ID concurrently (max 20 IDs). Useful for scanning dependency lists extracted from pull requests. Returns a dict of {cve_id: result} with severity info for each entry.
Inputs: cve_ids (required). Returns: object
Get high-severity CVEs (CVSS >= 7.0) from the last N days (1-365). Fast. Covers Critical (9.0-10.0) and High (7.0-8.9) severity. Example: check_high_severity_cves(7) — this week's critical threats.
Inputs: days. Returns: object
Get a detailed CVSS v3/v4 breakdown for a CVE: base score, vector string, and individual metrics (Attack Vector, Complexity, Privileges Required, User Interaction, Scope, Confidentiality/Integrity/Availability Impact). Uses NVD which carries the richest CVSS data.
Inputs: cve_id (required). Returns: object
Get CVEs published in the last N days (1-365). Fast. Returns a list with severity analysis and alert level. Example: get_recent_cves(7, 30) — last week's top 30 CVEs.
Inputs: days, limit. Returns: object
Get CVE database statistics: total count, last updated timestamp, and source info. Fast. Useful for health checks and confirming database freshness before analysis.
Inputs: no named parameters. Returns: object
Smart CVE search by technology/library keyword. Fast. Normalizes common variations ("Node.js", "Spring Boot", "log4j2"). Searches NVD, GitHub Advisory, and OSV concurrently and deduplicates results. Example: search_by_keyword("nodejs"), search_by_keyword("spring boot").
Inputs: keyword (required), limit. Returns: object
Search for a specific CVE by exact ID (e.g., CVE-2021-44228). Use when you have a CVE ID from code, docs, or security reports. Returns complete CVE details with CVSS score and severity analysis.
Inputs: cve_id (required). Returns: object
Search vulnerabilities by vendor and product name (e.g., vendor="apache", product="struts"). WARNING: This can be slow (10-15 seconds). Use search_by_keyword for faster results. Returns matched vulnerabilities with severity summary.
Inputs: vendor (required), product (required), limit. Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 8 tools
Tools have mostly distinct purposes, but get_recent_cves and check_high_severity_cves both retrieve recent CVEs, differing only by severity filter. Bulk vs single CVE lookup also overlap slightly. Descriptions help disambiguate.
All tool names follow a consistent verb_noun pattern with underscores and are descriptive, e.g., search_by_keyword, get_recent_cves. No mixing of conventions.
8 tools is well-scoped for a CVE search server, covering various lookup methods and utility functions without being excessive.
Covers key CVE lookup methods (by ID, keyword, product, date range, severity) and stats. Missing advanced features like subscription or CVE creation, but core search is complete.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
