de en es ja ko ru zh

nist-mcp

Name: nist-mcp
Author: ball2jh

by ball2jh

Overview Schema Source Related Servers Discussions Admin

Python

Local

nist-mcp

Ein kleiner Model Context Protocol (MCP)-Server, der KI-Assistenten strukturierten Zugriff auf den NIST-Cybersicherheitskatalog bietet: Publikationen, SP 800-53 Rev 5-Kontrollen, CSF 2.0, CMVP-Module, NCP-Checklisten, Glossarbegriffe, NICE-Arbeitsrollen sowie aktuelle NVD CVE/CPE-Daten. Lokale NIST-Daten werden aus einem SQLite-Index bereitgestellt, der bei der ersten Verwendung automatisch durch das Herunterladen strukturierter Daten direkt von NIST erstellt wird.

Installation

Direkt von GitHub installieren:

pipx install git+https://github.com/ball2jh/nist-mcp.git
# or
pip install git+https://github.com/ball2jh/nist-mcp.git

Für die lokale Entwicklung:

git clone https://github.com/ball2jh/nist-mcp.git
cd nist-mcp
pip install -e ".[dev,scraper]"

Related MCP server: NIST NVD MCP Server

Konfiguration

Umgebungsvariablen

Variable	Standard	Beschreibung
`NIST_MCP_DATA_DIR`	`~/.nist-mcp`	Verzeichnis für die lokale Datenbank und zwischengespeicherte Dokumente
`NIST_MCP_NVD_API_KEY`	(keine)	Optionaler NVD-API-Schlüssel für höhere Ratenbegrenzungen (empfohlen)
`NIST_MCP_UPDATE_INTERVAL`	`604800`	Sekunden zwischen Hintergrund-Datenbank-Aktualisierungen (Standard: 7 Tage)

config.toml

Erstellen Sie ~/.nist-mcp/config.toml (oder $NIST_MCP_DATA_DIR/config.toml) für dauerhafte Einstellungen:

nvd_api_key = "your-api-key-here"
update_interval = 43200   # 12 hours

Umgebungsvariablen haben Vorrang vor der Konfigurationsdatei.

MCP-Client-Konfiguration

Fügen Sie dies zur Serverliste Ihres MCP-Clients hinzu (z. B. Claude Desktop claude_desktop_config.json):

{
  "mcpServers": {
    "nist": {
      "command": "nist-mcp",
      "env": {
        "NIST_MCP_NVD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Beim ersten Start erstellt der Server eine lokale Datenbank, indem er strukturierte Daten von NIST herunterlädt (~2 Sekunden). Die Datenbank wird zwischengespeichert und bei Veraltung automatisch neu erstellt (Standard: alle 7 Tage).

MCP-Sicherheitshinweise

Dieser Server ist für den Betrieb als lokaler stdio-MCP-Server vorgesehen. Er stellt keinen HTTP-Listener bereit, daher ist der Zugriff auf den MCP-Client-Prozess beschränkt, der ihn startet. Protokolle werden über die Python-Protokollierung geschrieben, die standardmäßig in stderr schreibt und den stdio JSON-RPC-Datenverkehr nicht beschädigt.

Tool-Schemata schränken gängige Optionssätze und Ergebnisgrößen ein. Dokument-Downloads sind auf HTTPS-URLs von bekannten NIST-Publikations-Hosts beschränkt, Weiterleitungen werden erneut validiert, Dateinamen werden vor dem Schreiben in den lokalen Cache bereinigt und die Seitenextraktion ist auf 50 Seiten pro Anfrage begrenzt. Tools, die lokale Daten herunterladen, zwischenspeichern oder neu erstellen, sind als nicht destruktiv, aber nicht rein schreibgeschützt gekennzeichnet, damit Clients eine entsprechende Bestätigungs-Benutzeroberfläche anzeigen können.

Verfügbare Tools

Tool	Beschreibung
`search_nist`	Durchsucht lokale NIST-Katalogdaten über Publikationen, Kontrollen, CSF, Glossar, CMVP, Checklisten und NICE hinweg
`get_nist_record`	Ruft einen einzelnen lokalen NIST-Datensatz nach Quelle und ID ab
`read_publication`	Lädt Publikationsinhalte herunter/zwischenspeichert sie und liest sie als Markdown; gibt standardmäßig ein PDF-Inhaltsverzeichnis zurück
`search_nvd`	Durchsucht aktuelle NVD CVE- oder CPE-Daten
`get_cve`	Ruft eine CVE mit CVSS, Schwachstellen, Referenzen, KEV-Status und optionalem Änderungsverlauf ab
`database_status`	Zeigt Erstellungsdatum, Größe, Aktualität und Dateipfad der Datenbank an
`update_database`	Erstellt den lokalen NIST-Index neu, indem aktuelle Daten von NIST-Quellen heruntergeladen werden

Verfügbare Ressourcen

URI	Beschreibung
`nist://about`	Serverversion, Datenbankaktualität und Kurzanleitung für Tools

Kurze Beispiele

NIST-Leitlinien zu Zero Trust finden

search_nist("zero trust architecture")

Die Publikation SP 800-207 nachschlagen

search_nist("zero trust", source="publications")
get_nist_record(source="publications", record_id="SP.800-207")

Zugriffskontrollanforderungen für ein MODERATE-System überprüfen

search_nist("account management", source="controls", detail="standard")
get_nist_record(source="controls", record_id="AC-2")

Log4Shell analysieren

get_cve("CVE-2021-44228")

Überprüfen, ob Ihre kryptografische Bibliothek FIPS-validiert ist

search_nist("OpenSSL", source="cmvp")

CSF-Leitlinien zur Reaktion auf Vorfälle finden

search_nist("incident response", source="csf")

Lizenz

MIT-Lizenz. Beachten Sie, dass pymupdf4llm, das für die PDF-zu-Markdown-Konvertierung verwendet wird, unter der AGPL-3.0 lizenziert ist.

Available Tools

20 tools

database_statusA

Read-onlyIdempotent

Show the current NIST metadata index status: build date, last update check, database size, and file path. Use this to verify the database is available and check data freshness.

Name	Required	Description	Default
No parameters

Output Schema

Name	Required	Description
`result`	Yes

download_documentA

Download a publication PDF or supplemental material to local cache. Returns the file path. Use material_index to download a specific supplemental file listed in the get_publication output.

Name	Required	Description	Default
`publication_id`	Yes	Publication ID
`material_index`	No	Index of supplemental material (from get_publication output)

Output Schema

Name	Required	Description
`result`	Yes

get_controlA

Read-onlyIdempotent

Get complete details for a specific SP 800-53 Rev 5 control: statement, guidance, parameters, related controls, baselines, and cross-framework mappings.

Set include_enhancements=True to also get all enhancement sub-controls. Do NOT use this for searching -- use search_controls to find controls first.

Name	Required	Description	Default
`control_id`	Yes	Control ID, e.g. 'AC-2', 'ac-2', 'IA-5(1)'
`include_enhancements`	No	Include all enhancements

Output Schema

Name	Required	Description
`result`	Yes

get_csf_dataA

Read-onlyIdempotent

Browse/search the NIST CSF 2.0 framework hierarchy. No args = list all 6 functions. function="PR" = Protect categories. category="PR.AC" = subcategories. query="risk" = full-text search. Includes count of mapped SP 800-53 controls per entry.

Name	Required	Description	Default
`function`	No	CSF function ID, e.g. 'PR', 'ID', 'GV'
`category`	No	CSF category ID, e.g. 'PR.AC', 'ID.AM'
`query`	No	Full-text search across CSF entries
`detail_level`	No	Output verbosity: summary, standard, or full	summary

Output Schema

Name	Required	Description
`result`	Yes

get_cveA

Read-only

Get full details for a CVE: description, CVSS scores, affected products (CPE), CWE classification, references, and CISA KEV status (if exploited: date added, due date, required action). Use this after search_cves to get complete vulnerability details. May take 6+ seconds without an NVD API key due to rate limiting.

Name	Required	Description	Default
`cve_id`	Yes	CVE identifier, e.g. 'CVE-2021-44228'

Output Schema

Name	Required	Description
`result`	Yes

get_cve_historyA

Read-only

Get the change history for a CVE — when it was modified, what changed (score updates, CPE additions, CWE remaps). May take 6+ seconds without an NVD API key due to rate limiting.

Name	Required	Description	Default
`cve_id`	Yes	CVE identifier, e.g. 'CVE-2021-44228'

Output Schema

Name	Required	Description
`result`	Yes

get_document_contentA

Retrieve publication content as Markdown. Without section/pages, returns table of contents. With section, returns that section. With pages, returns those pages. Handles PDF, XLSX, CSV, JSON, and XML formats. Results are cached locally.

Use this to read the actual content of NIST documents. For large documents like SP 800-53 (492 pages), use the pages parameter to request specific page ranges.

Name	Required	Description
`publication_id`	Yes	Publication ID
`section`	No	Section heading to extract
`pages`	No	Page range, e.g. '1-50'

Output Schema

Name	Required	Description
`result`	Yes

get_framework_mappingsA

Read-onlyIdempotent

Cross-reference frameworks. 'What CSF maps to AC-1?' or 'What 800-53 controls implement PR.AC?' Bidirectional lookup in the mappings table.

Name	Required	Description	Default
`source_id`	Yes	Control or CSF ID, e.g. 'ac-1', 'PR.AC-01', 'cm-8'
`target_framework`	No	Filter results by framework, e.g. 'CSF.2.0', 'SP.800-53.r5', 'CSF.1.1'

Output Schema

Name	Required	Description
`result`	Yes

get_latest_revisionA

Read-onlyIdempotent

Resolve any publication to its newest available revision. Follows the supersedes chain. Use this when you need the most current version of a document.

Name	Required	Description	Default
`publication_id`	Yes	Any publication ID, e.g. 'SP.800-53-Rev.-5'

Output Schema

Name	Required	Description
`result`	Yes

get_publicationA

Read-onlyIdempotent

Get full metadata for a specific NIST publication including title, abstract, authors, date, supersedes chain, related publications, and list of supplemental materials.

Name	Required	Description	Default
`publication_id`	Yes	Publication ID, e.g. 'SP.800-53-Rev.-5' or 'FIPS.140-3'

Output Schema

Name	Required	Description
`result`	Yes

lookup_glossaryA

Read-onlyIdempotent

Look up NIST cybersecurity/privacy terms. Use 'term' for exact match, 'query' for keyword search. Returns definition, authoritative source, and related terms.

Name	Required	Description
`term`	No	Exact term to look up, e.g. 'Access Control'
`query`	No	Keyword search across term and definition
`limit`	No	Maximum number of results

Output Schema

Name	Required	Description
`result`	Yes

search_checklistsB

Read-onlyIdempotent

Search NCP security configuration checklists. 'SCAP checklists for Windows Server 2022' or 'CIS benchmarks for Ubuntu'.

Name	Required	Description
`product`	No	Product name, e.g. 'Windows Server 2022', 'Ubuntu'
`format`	No	Checklist format: XCCDF, OVAL, PDF, etc.
`authority`	No	Issuing authority, e.g. 'DISA', 'CIS', 'NIST'
`query`	No	Full-text search across name, product, and description
`limit`	No
`offset`	No

Output Schema

Name	Required	Description
`result`	Yes

search_cmvpA

Read-onlyIdempotent

Search FIPS 140-2/3 validated cryptographic modules. 'Is OpenSSL FIPS validated?' or 'Which modules support AES-256-GCM at Level 2?'

Name	Required	Description	Default
`vendor`	No	Vendor/company name substring, e.g. 'Google', 'OpenSSL'
`module_name`	No	Module name substring, e.g. 'BoringCrypto', 'OpenSSL'
`fips_level`	No	FIPS validation level: 1, 2, or 3
`algorithm`	No	Algorithm name, e.g. 'AES', 'RSA', 'SHA-256'
`status`	No	Validation status: Active, Historical, Revoked	Active
`limit`	No
`offset`	No

Output Schema

Name	Required	Description
`result`	Yes

search_controlsA

Read-onlyIdempotent

Search NIST SP 800-53 Rev 5 security and privacy controls by keyword, family, or baseline. Accepts flexible ID formats (AC-2, ac-2, AC2 all work).

summary: label + title (~50 tokens/result) standard: + statement text + baselines (~200 tokens/result) full: + guidance + parameters + related controls (~500+ tokens/result)

Use get_control for the complete detail of a specific control including enhancements.

Name	Required	Description	Default
`query`	No	Search keywords
`family`	No	Control family ID, e.g. 'ac', 'ia', 'sc'
`baseline`	No	Baseline level: LOW, MODERATE, HIGH
`include_withdrawn`	No	Include withdrawn controls
`detail_level`	No	summary, standard, or full	summary
`limit`	No
`offset`	No

Output Schema

Name	Required	Description
`result`	Yes

search_cpesA

Read-only

Search the NVD CPE (Common Platform Enumeration) database for products and platforms. May take 6+ seconds without an NVD API key due to rate limiting.

Name	Required	Description
`keyword`	No	Keyword search, e.g. 'Apache Tomcat', 'Windows Server 2022'
`match_string`	No	CPE match string prefix, e.g. 'cpe:2.3:a:apache:tomcat'
`limit`	No
`offset`	No

Output Schema

Name	Required	Description
`result`	Yes

search_cvesA

Read-only

Search the NVD CVE database. Supports keyword, CVSS severity, CPE product, CWE weakness type, and date range filters. Set has_kev=True for only CISA Known Exploited Vulnerabilities. Results include CVE ID, description, severity, and score. May take 6+ seconds without an NVD API key due to rate limiting.

Name	Required	Description
`keyword`	No	Keyword search across CVE descriptions, e.g. 'Apache Log4j'
`severity`	No	CVSS v3 severity: CRITICAL, HIGH, MEDIUM, or LOW
`cpe_name`	No	CPE 2.3 product name, e.g. 'cpe:2.3:a:apache:log4j:*'
`cwe_id`	No	CWE weakness ID, e.g. 'CWE-79'
`pub_start`	No	Publication start date in ISO 8601, e.g. '2024-01-01T00:00:00.000'
`pub_end`	No	Publication end date in ISO 8601, e.g. '2024-12-31T23:59:59.999'
`has_kev`	No	If True, only return CVEs that are in the CISA KEV catalog
`limit`	No
`offset`	No

Output Schema

Name	Required	Description
`result`	Yes

search_nice_rolesB

Read-onlyIdempotent

Search NICE Framework work roles. 'What role handles incident response?'

Name	Required	Description
`query`	No	Search terms, e.g. 'incident response', 'penetration testing'
`category`	No	NICE category: 'Analyze', 'Collect and Operate', 'Investigate', 'Operate and Maintain', 'Oversee and Govern', 'Protect and Defend', 'Securely Provision'
`limit`	No

Output Schema

Name	Required	Description
`result`	Yes

search_nistA

Read-onlyIdempotent

Search across ALL NIST data: publications, SP 800-53 controls, CSF framework, glossary, CMVP modules, checklists, and NICE roles. Results grouped by type.

Use this as a starting point when you're not sure which specific tool to use. For targeted searches, use domain-specific tools (search_publications, search_controls, etc.).

scope options: publications, controls, csf, glossary, cmvp, checklists, nice

Name	Required	Description
`query`	Yes	Search keywords
`scope`	No	Limit search to one data type: publications, controls, csf, glossary, cmvp, checklists, nice
`limit`	No

Output Schema

Name	Required	Description
`result`	Yes

search_publicationsA

Read-onlyIdempotent

Search NIST publications by keyword across all series (SP 800, SP 1800, FIPS, IR, CSWP, AI).

Returns matching publications with ID, title, date, and series. Use get_publication for full details on a specific publication. Default shows only the latest revision of each document. Do NOT use this for SP 800-53 security controls -- use search_controls instead.

Name	Required	Description	Default
`query`	Yes	Search keywords (title, abstract, topic)
`series`	No	Filter by series: SP, FIPS, IR, CSWP, AI
`status`	No	Filter by status: Final, Draft, Withdrawn
`pub_type`	No	Filter by type: Standard, Guideline, Framework, etc.
`latest_only`	No	Only show newest revision of each document
`detail_level`	No	summary, standard, or full	summary
`limit`	No	Max results
`offset`	No	Pagination offset

Output Schema

Name	Required	Description
`result`	Yes

update_databaseA

Rebuild the NIST metadata index by downloading fresh data from NIST sources (XLSX, JSON, ZIP). Takes about 5-10 seconds. Use this if you need the most current publication or control data.

Name	Required	Description	Default
No parameters

Output Schema

Name	Required	Description
`result`	Yes

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

20 tool updatesv0.1.0Mar 23, 2026
- First observeddatabase_status
- First observeddownload_document
- First observedget_control
- First observedget_csf_data
- First observedget_cve
- First observedget_cve_history
- First observedget_document_content
- First observedget_framework_mappings
- First observedget_latest_revision
- First observedget_publication
- First observedlookup_glossary
- First observedsearch_checklists
- First observedsearch_cmvp
- First observedsearch_controls
- First observedsearch_cpes
- First observedsearch_cves
- First observedsearch_nice_roles
- First observedsearch_nist
- First observedsearch_publications
- First observedupdate_database

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.1/5.0

Scored 2026-04-13 03:25 across 20 tools

Disambiguation4/5

Most tools have distinct purposes with clear boundaries, such as get_control for detailed control information versus search_controls for finding controls. However, some overlap exists between search_nist and domain-specific search tools, which could cause confusion about which to use first, though descriptions help clarify their roles.

Naming Consistency5/5

Tool names follow a highly consistent verb_noun pattern throughout, such as get_control, search_cves, and update_database. This predictability makes it easy for agents to understand and navigate the toolset without naming confusion.

Tool Count4/5

With 20 tools, the count is slightly high but reasonable for the broad scope of NIST cybersecurity data, covering publications, controls, vulnerabilities, and frameworks. It might feel heavy, but each tool appears to serve a specific function without obvious redundancy.

Completeness5/5

The toolset provides comprehensive coverage for the NIST cybersecurity domain, including CRUD-like operations (e.g., get, search, update), cross-referencing, and content retrieval. No significant gaps are apparent, supporting full agent workflows from discovery to detailed analysis.

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

nist-nvd-mcp-serverA
io.github.cyanheads
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
Penetration Testing Government Data
512
https://nist-nvd.caseyjhand.com/mcp
Security Intel MCPA
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp
Security Intel MCPA
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
https://security.selflabbs.com/mcp
AIBITIOUS 404 - CVE EvidenceB
io.github.aibitious
Free NIST NVD CVE evidence lookup and opt-in public missing-information reports for AI agents.
21
https://aibitious.com/404/mcp/

Related MCP Servers

CVE MCP Server
Security Databases Search
davidculver
A
license
B
quality
D
maintenance
Provides conversational access to a local CVE (Common Vulnerabilities and Exposures) database, enabling natural language queries to search vulnerabilities, retrieve detailed CVE information, and view security statistics.
Updated 10 months ago (2025-12-30 16:16 UTC)
3
MIT
NIST NVD MCP Server
Government Data Security
Cyreslab-AI
A
license
A
quality
C
maintenance
Enables AI agents to search, retrieve, and analyze vulnerability data from the NIST National Vulnerability Database through a comprehensive Model Context Protocol server.
Updated 2 months ago (2026-09-20 12:01 UTC)
8
9
MIT
NIST MCP Server
Security Legal & Compliance
tnicholson
A
license
Not graded
quality
D
maintenance
Provides comprehensive access to NIST cybersecurity frameworks and controls, enabling AI assistants and applications to query, analyze, and manage NIST security controls through a standardized interface.
Updated a year ago (2025-10-07 03:32 UTC)
10
MIT
cve-lookup-mcp
Security Open Data
Aashish-32
A
license
A
quality
D
maintenance
Provides live CVE data from NVD and EPSS without API key, enabling AI assistants to look up CVSS scores, search vulnerabilities, and check product CVEs.
Updated 5 months ago (2026-06-21 11:17 UTC)
3
MIT

nist-mcp

Installation

Konfiguration

Umgebungsvariablen

config.toml

MCP-Client-Konfiguration

MCP-Sicherheitshinweise

Verfügbare Tools

Verfügbare Ressourcen

Kurze Beispiele

NIST-Leitlinien zu Zero Trust finden

Die Publikation SP 800-207 nachschlagen

Zugriffskontrollanforderungen für ein MODERATE-System überprüfen

Log4Shell analysieren

Überprüfen, ob Ihre kryptografische Bibliothek FIPS-validiert ist

CSF-Leitlinien zur Reaktion auf Vorfälle finden

Lizenz

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

CVE MCP Server

NIST NVD MCP Server

NIST MCP Server

cve-lookup-mcp