nvd-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Optional NVD API key for higher rate limits (5 requests per 30 seconds without key). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lookup_cveA | Look up full details for a specific CVE by ID. |
| search_cvesA | Search for CVEs by product name or keyword. |
| summarize_riskA | Aggregate a risk summary for a list of CVE IDs. Fetches each CVE from NVD, computes a weighted composite risk score, and returns a severity breakdown with prioritized remediation guidance. Risk score formula: |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a distinct purpose: lookup a specific CVE, search by keyword, and aggregate risk for multiple CVEs. No overlap in functionality.
All tools use a consistent verb_noun snake_case pattern: lookup_cve, search_cves, summarize_risk.
Three tools is slightly on the low side but appropriate for a focused NVD query and risk assessment domain. Each tool is essential.
The tool set covers the full workflow: finding CVEs (search), getting details (lookup), and summarizing risk (summarize). No obvious gaps for the intended purpose.