NVD MCP Server

Python MCP server for querying the NVD Vulnerability API 2.0 (NIST).

Features

• Detailed query by CVE identifier.

• Search by keyword, CPE, CWE, CVSS v3 severity, and CISA KEV catalog.

• Query vulnerabilities by publication date range.

• MCP transport via SSE for remote use or STDIO for local execution.

• Runs in a Docker container with a non-root user.

Related MCP server: nvd-cve-mcp-server

Requirements

• Python 3.10 or higher, or Docker with Docker Compose.

• Optionally, an NVD API key in the NVD_API_KEY variable.

Running with Docker Compose

docker compose up --build

By default, the server is available at http://localhost:8000/sse.

To use an NVD API key, set NVD_API_KEY in the environment before starting Compose:

NVD_API_KEY=sua-chave docker compose up --build

In PowerShell:

$env:NVD_API_KEY = "sua-chave"
docker compose up --build

Local execution

Install the dependencies and start the SSE server:

python -m pip install -r requirements.txt
python nvd_mcp_server.py

To use STDIO:

MCP_TRANSPORT=stdio python nvd_mcp_server.py

In PowerShell:

$env:MCP_TRANSPORT = "stdio"
python nvd_mcp_server.py

The MCP_HOST, MCP_PORT, and MCP_TRANSPORT variables allow you to adjust the transport and listening address.

MCP Tools

• get_cve_details: returns the details of a CVE.

• search_vulnerabilities: searches vulnerabilities with filters.

• get_recent_vulnerabilities_by_date: queries publications within a date range.

Client configuration

The agent_config.json file contains an example configuration for a remote MCP client. Change the URL to the server's actual address before using it.

License

This project does not define a license. Consult the owner before reusing the code in other projects.