cve-reference-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GITHUB_TOKEN | No | GitHub token for higher rate limits when collecting GitHub Advisory data |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_cve_referencesA | CVE ID를 입력받아 CVE 안내서 작성용 참고자료 목록을 반환합니다. NVD, CIRCL, OSV, EPSS, GitHub Advisory 등 복수 원본에서 수집합니다. |
| get_cve_summaryB | CVE ID의 핵심 정보만 요약하여 반환합니다. (NVD + EPSS 기반 간략 요약) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 2 tools
Both tools accept a CVE ID, but their purposes are clearly differentiated: one returns a list of references from multiple sources, and the other returns a concise summary of key information. While an agent must read the descriptions to choose correctly, there is no overlap in output type.
Both tool names follow a consistent get_cve_<noun> pattern, with 'references' and 'summary' clearly indicating their distinct functions. This is a uniform and predictable naming convention.
With only two tools, the set feels thin for a server dedicated to CVE references. However, it is narrowly scoped and may be adequate for the intended use case of gathering references and summaries for CVE guides.
The server covers two core operations: fetching references and providing summaries. Notable gaps exist, such as fetching detailed CVE metadata or searching by keyword, which an agent might expect from a CVE reference tool. Still, the provided tools cover the primary workflow without dead ends.