CVE MCP Server
by Liohtml
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Host to bind when serving over HTTP transport (default 0.0.0.0). | |
| PORT | No | Port to bind when serving over HTTP transport (default 8000). | |
| SHODAN_KEY | No | Shodan API key for host/port/service reconnaissance. Free tier provides basic host lookups. Required for the shodan_host_lookup tool. | |
| MAX_RETRIES | No | Number of retries on transient errors. Defaults to 3. | |
| NVD_API_KEY | No | NVD API key — free at https://nvd.nist.gov/developers/request-an-api-key. Without key: 5 req/30s | With key: 50 req/30s (10× faster NVD lookups). Optional but strongly recommended. | |
| URLSCAN_KEY | No | URLScan.io API key for URL scanning and website analysis. Free tier: 5,000 public scans/day. Required for the urlscan_check tool. | |
| GITHUB_TOKEN | No | GitHub token — increases rate limit from 60/hr to 5000/hr (no scopes needed). Enables GitHub Advisory search and exploit/PoC code search. | |
| ABUSEIPDB_KEY | No | AbuseIPDB API key for IP reputation lookups. Free tier: 1,000 checks/day. Required for the lookup_ip_reputation tool. | |
| CACHE_DB_PATH | No | Path to the SQLite cache database. Defaults to ~/.cve-mcp/cache.db. | |
| MCP_TRANSPORT | No | Transport mode. Set to 'http' to serve streamable-HTTP on HOST:PORT (default '0.0.0.0:8000', stateless) instead of the default stdio transport. | |
| AUDIT_LOG_PATH | No | Path to the rotating audit log. Defaults to ~/.cve-mcp/audit.log. | |
| VIRUSTOTAL_KEY | No | VirusTotal API key for file/URL/domain/IP malware scanning (70+ AV engines). Free tier: 500 lookups/day, 4/min. Required for the virustotal_lookup tool. | |
| CIRCL_PDNS_PASS | No | CIRCL Passive DNS password (HTTP Basic Auth). Provided with CIRCL registration. Partner access only. Required for the passive_dns_lookup tool. | |
| CIRCL_PDNS_USER | No | CIRCL Passive DNS username (HTTP Basic Auth). Partner access only. Required for the passive_dns_lookup tool. | |
| REQUEST_TIMEOUT | No | HTTP timeout in seconds. Defaults to 30. | |
| VULNCHECK_TOKEN | No | VulnCheck NVD++ bearer token (free Community tier). Used as a transparent NVD fallback inside triage_cve when NIST NVD is unreachable or throttled. | |
| ABUSECH_AUTH_KEY | No | Abuse.ch Auth-Key for MalwareBazaar and ThreatFox queries (search_malware, search_iocs). Optional; fair use. | |
| GREYNOISE_API_KEY | No | GreyNoise API key for IP noise/scan activity intelligence (uses the /v3/ip/{ip} endpoint). Community tier: 50 queries/week. Required for the check_ip_noise tool. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityInactive
ResponsivenessNo issues