VulnerabilityMCPServer

Test d'un serveur MCP local sur le protocol HTTP

Prerequisites

A python version 3.9+ should be installed

NPM should be installed (using NodeJS installation)

Related MCP server: CIRCL CVE SEARCH MCP Server

Set up environment

1. Clone the Github repo

2. Create a virtual environment linked to the project

python -m venv <PATH_TO_YOU_VENV_FOLDER>\VulnerabilityMCPServer

3. Start the virtual environment

<PATH_TO_YOU_VENV_FOLDER>\Scripts\Activate.ps1

Use other script based on your environment type (activate / activate.bat)

4. Install python packages

pip install -e .

This installs every dependency needed to both run the MCP server and use the vuln-db CLI (also registered by this command), from the single pyproject.toml manifest.

5. Build the local vulnerability database

The server reads from a local SQLite database (data/vulnerability.db, git-ignored) that must be built before first use, with the vuln-db CLI (always run from the repo root):

vuln-db --init

--init creates the database tables and does a full live sync against NVD/EPSS (CVE + EPSS data), plus the CPE dictionary and CPE-match feeds used by the resolve_cpe/search_cves_by_cpe tools. It's required on first run, is safe to rerun, and can take a while (the CPE-match feed alone is ~795MB compressed).

6. Launch the MCP server

fastmcp run

The terminal should render:

The default configuation is set by file fastmcp.json

{
  "$schema": "https://gofastmcp.com/public/schemas/fastmcp.json/v1.json",
  "source": {
    "path": "src/vulnerability-mcp-server.py",
    "entrypoint": "mcp"
  },
  "deployment": {
    "transport": "streamable-http",
    "port":8000,
    "path": "/nvd-mcp",
    "log_level": "INFO"
  }
}

Test MCP server

Open another terminal and launch the command

npx @modelcontextprotocol/inspector

if a prompt ask you if you want to install the package accept

Now a browser is opened and display MCP inspector

Click on Add Servers and select + Add manually

Set NVD-MCP as Server ID

Select streamable-http as Transport

Set URL with http://localhost:8000/nvd-mcp and click on Add

A new server appears:

Toggle on the Connection button at the top-right of the server card

Some info should appear on a right side bar.

Click on Tools and select get_cve_by_id.

Fill cve_id with for example CVE-2025-53770

Available tools

All tools are 100% local at query time (they read from data/vulnerability.db, no outbound network calls, no API key required):

See AGENTS.md for the full details of each tool (return shapes, match precision semantics, etc.).

Run OpenCode

Now you can run OpenCode in a third terminal.

opencode

you get

use the command /mcps to list mcp servers

Now test the following prompt

get info about vulnerability with id  CVE-2025-53770 and trace if you used a mcp server and a tool in your response

We get the following response with local LLM qwen3.6:latest

We get the following response with remote Claude Sonnet 5