Ein kleiner Model Context Protocol (MCP)-Server, der KI-Assistenten strukturierten Zugriff auf den NIST-Cybersicherheitskatalog bietet: Publikationen, SP 800-53 Rev 5-Kontrollen, CSF 2.0, CMVP-Module, NCP-Checklisten, Glossarbegriffe, NICE-Arbeitsrollen sowie aktuelle NVD CVE/CPE-Daten. Lokale NIST-Daten werden aus einem SQLite-Index bereitgestellt, der bei der ersten Verwendung automatisch durch das Herunterladen strukturierter Daten direkt von NIST erstellt wird.
Direkt von GitHub installieren:
pipx install git+https://github.com/ball2jh/nist-mcp.git
# or
pip install git+https://github.com/ball2jh/nist-mcp.gitFür die lokale Entwicklung:
git clone https://github.com/ball2jh/nist-mcp.git
cd nist-mcp
pip install -e ".[dev,scraper]"Related MCP server: NIST NVD MCP Server
Variable | Standard | Beschreibung |
|
| Verzeichnis für die lokale Datenbank und zwischengespeicherte Dokumente |
| (keine) | Optionaler NVD-API-Schlüssel für höhere Ratenbegrenzungen (empfohlen) |
|
| Sekunden zwischen Hintergrund-Datenbank-Aktualisierungen (Standard: 7 Tage) |
Erstellen Sie ~/.nist-mcp/config.toml (oder $NIST_MCP_DATA_DIR/config.toml) für dauerhafte Einstellungen:
nvd_api_key = "your-api-key-here"
update_interval = 43200 # 12 hoursUmgebungsvariablen haben Vorrang vor der Konfigurationsdatei.
Fügen Sie dies zur Serverliste Ihres MCP-Clients hinzu (z. B. Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"nist": {
"command": "nist-mcp",
"env": {
"NIST_MCP_NVD_API_KEY": "your-api-key-here"
}
}
}
}Beim ersten Start erstellt der Server eine lokale Datenbank, indem er strukturierte Daten von NIST herunterlädt (~2 Sekunden). Die Datenbank wird zwischengespeichert und bei Veraltung automatisch neu erstellt (Standard: alle 7 Tage).
Dieser Server ist für den Betrieb als lokaler stdio-MCP-Server vorgesehen. Er stellt keinen HTTP-Listener bereit, daher ist der Zugriff auf den MCP-Client-Prozess beschränkt, der ihn startet. Protokolle werden über die Python-Protokollierung geschrieben, die standardmäßig in stderr schreibt und den stdio JSON-RPC-Datenverkehr nicht beschädigt.
Tool-Schemata schränken gängige Optionssätze und Ergebnisgrößen ein. Dokument-Downloads sind auf HTTPS-URLs von bekannten NIST-Publikations-Hosts beschränkt, Weiterleitungen werden erneut validiert, Dateinamen werden vor dem Schreiben in den lokalen Cache bereinigt und die Seitenextraktion ist auf 50 Seiten pro Anfrage begrenzt. Tools, die lokale Daten herunterladen, zwischenspeichern oder neu erstellen, sind als nicht destruktiv, aber nicht rein schreibgeschützt gekennzeichnet, damit Clients eine entsprechende Bestätigungs-Benutzeroberfläche anzeigen können.
Tool | Beschreibung |
| Durchsucht lokale NIST-Katalogdaten über Publikationen, Kontrollen, CSF, Glossar, CMVP, Checklisten und NICE hinweg |
| Ruft einen einzelnen lokalen NIST-Datensatz nach Quelle und ID ab |
| Lädt Publikationsinhalte herunter/zwischenspeichert sie und liest sie als Markdown; gibt standardmäßig ein PDF-Inhaltsverzeichnis zurück |
| Durchsucht aktuelle NVD CVE- oder CPE-Daten |
| Ruft eine CVE mit CVSS, Schwachstellen, Referenzen, KEV-Status und optionalem Änderungsverlauf ab |
| Zeigt Erstellungsdatum, Größe, Aktualität und Dateipfad der Datenbank an |
| Erstellt den lokalen NIST-Index neu, indem aktuelle Daten von NIST-Quellen heruntergeladen werden |
URI | Beschreibung |
| Serverversion, Datenbankaktualität und Kurzanleitung für Tools |
search_nist("zero trust architecture")search_nist("zero trust", source="publications")
get_nist_record(source="publications", record_id="SP.800-207")search_nist("account management", source="controls", detail="standard")
get_nist_record(source="controls", record_id="AC-2")get_cve("CVE-2021-44228")search_nist("OpenSSL", source="cmvp")search_nist("incident response", source="csf")MIT-Lizenz. Beachten Sie, dass pymupdf4llm, das für die PDF-zu-Markdown-Konvertierung verwendet wird, unter der AGPL-3.0 lizenziert ist.
Show the current NIST metadata index status: build date, last update check, database size, and file path. Use this to verify the database is available and check data freshness.
Inputs: no named parameters. Returns: result
Download a publication PDF or supplemental material to local cache. Returns the file path. Use material_index to download a specific supplemental file listed in the get_publication output.
Inputs: publication_id (required), material_index. Returns: result
Get complete details for a specific SP 800-53 Rev 5 control: statement, guidance, parameters, related controls, baselines, and cross-framework mappings.
Set include_enhancements=True to also get all enhancement sub-controls. Do NOT use this for searching -- use search_controls to find controls first.
Inputs: control_id (required), include_enhancements. Returns: result
Browse/search the NIST CSF 2.0 framework hierarchy. No args = list all 6 functions. function="PR" = Protect categories. category="PR.AC" = subcategories. query="risk" = full-text search. Includes count of mapped SP 800-53 controls per entry.
Inputs: function, category, query, detail_level. Returns: result
Get full details for a CVE: description, CVSS scores, affected products (CPE), CWE classification, references, and CISA KEV status (if exploited: date added, due date, required action). Use this after search_cves to get complete vulnerability details. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: cve_id (required). Returns: result
Get the change history for a CVE — when it was modified, what changed (score updates, CPE additions, CWE remaps). May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: cve_id (required). Returns: result
Retrieve publication content as Markdown. Without section/pages, returns table of contents. With section, returns that section. With pages, returns those pages. Handles PDF, XLSX, CSV, JSON, and XML formats. Results are cached locally.
Use this to read the actual content of NIST documents. For large documents like SP 800-53 (492 pages), use the pages parameter to request specific page ranges.
Inputs: publication_id (required), section, pages. Returns: result
Cross-reference frameworks. 'What CSF maps to AC-1?' or 'What 800-53 controls implement PR.AC?' Bidirectional lookup in the mappings table.
Inputs: source_id (required), target_framework. Returns: result
Resolve any publication to its newest available revision. Follows the supersedes chain. Use this when you need the most current version of a document.
Inputs: publication_id (required). Returns: result
Get full metadata for a specific NIST publication including title, abstract, authors, date, supersedes chain, related publications, and list of supplemental materials.
Inputs: publication_id (required). Returns: result
Look up NIST cybersecurity/privacy terms. Use 'term' for exact match, 'query' for keyword search. Returns definition, authoritative source, and related terms.
Inputs: term, query, limit. Returns: result
Search NCP security configuration checklists. 'SCAP checklists for Windows Server 2022' or 'CIS benchmarks for Ubuntu'.
Inputs: product, format, authority, query, +2 more. Returns: result
Search FIPS 140-2/3 validated cryptographic modules. 'Is OpenSSL FIPS validated?' or 'Which modules support AES-256-GCM at Level 2?'
Inputs: vendor, module_name, fips_level, algorithm, +3 more. Returns: result
Search NIST SP 800-53 Rev 5 security and privacy controls by keyword, family, or baseline. Accepts flexible ID formats (AC-2, ac-2, AC2 all work).
summary: label + title (~50 tokens/result) standard: + statement text + baselines (~200 tokens/result) full: + guidance + parameters + related controls (~500+ tokens/result)
Use get_control for the complete detail of a specific control including enhancements.
Inputs: query, family, baseline, include_withdrawn, +3 more. Returns: result
Search the NVD CPE (Common Platform Enumeration) database for products and platforms. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: keyword, match_string, limit, offset. Returns: result
Search the NVD CVE database. Supports keyword, CVSS severity, CPE product, CWE weakness type, and date range filters. Set has_kev=True for only CISA Known Exploited Vulnerabilities. Results include CVE ID, description, severity, and score. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: keyword, severity, cpe_name, cwe_id, +5 more. Returns: result
Search NICE Framework work roles. 'What role handles incident response?'
Inputs: query, category, limit. Returns: result
Search across ALL NIST data: publications, SP 800-53 controls, CSF framework, glossary, CMVP modules, checklists, and NICE roles. Results grouped by type.
Use this as a starting point when you're not sure which specific tool to use. For targeted searches, use domain-specific tools (search_publications, search_controls, etc.).
scope options: publications, controls, csf, glossary, cmvp, checklists, nice
Inputs: query (required), scope, limit. Returns: result
Search NIST publications by keyword across all series (SP 800, SP 1800, FIPS, IR, CSWP, AI).
Returns matching publications with ID, title, date, and series. Use get_publication for full details on a specific publication. Default shows only the latest revision of each document. Do NOT use this for SP 800-53 security controls -- use search_controls instead.
Inputs: query (required), series, status, pub_type, +4 more. Returns: result
Rebuild the NIST metadata index by downloading fresh data from NIST sources (XLSX, JSON, ZIP). Takes about 5-10 seconds. Use this if you need the most current publication or control data.
Inputs: no named parameters. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Scored across 20 tools
Most tools have distinct purposes with clear boundaries, such as get_control for detailed control information versus search_controls for finding controls. However, some overlap exists between search_nist and domain-specific search tools, which could cause confusion about which to use first, though descriptions help clarify their roles.
Tool names follow a highly consistent verb_noun pattern throughout, such as get_control, search_cves, and update_database. This predictability makes it easy for agents to understand and navigate the toolset without naming confusion.
With 20 tools, the count is slightly high but reasonable for the broad scope of NIST cybersecurity data, covering publications, controls, vulnerabilities, and frameworks. It might feel heavy, but each tool appears to serve a specific function without obvious redundancy.
The toolset provides comprehensive coverage for the NIST cybersecurity domain, including CRUD-like operations (e.g., get, search, update), cross-referencing, and content retrieval. No significant gaps are apparent, supporting full agent workflows from discovery to detailed analysis.
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Free NIST NVD CVE evidence lookup and opt-in public missing-information reports for AI agents.