cwe-search_mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cwe-search_mcpget information about CWE-79"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CWE Search MCP
A Python-based interface to MITRE's Common Weakness Enumeration (CWE) database via the official API, enabling seamless vulnerability research and integration with MCP-compatible systems.
Overview
The CWE Search MCP provides a robust Python implementation for interacting with MITRE's Common Weakness Enumeration (CWE) database through its official API. Designed for security researchers, developers, and vulnerability analysts, this mcp enables efficient querying of vulnerability information and integrates seamlessly with MCP-compatible systems using stdio transport.
This solution solves the problem of fragmented vulnerability research by providing a unified interface to:
Retrieve detailed CWE information programmatically
Explore vulnerability relationships and hierarchies
Integrate CWE data into security tooling and workflows
Automate vulnerability analysis and reporting
Related MCP server: Cybersecurity MCP Server
Key Features
Comprehensive Vulnerability Lookup: Retrieve detailed information by CWE ID
Intelligent Search: Find vulnerabilities by keyword across descriptions
Taxonomy Navigation: Explore CWE categories and views
Relationship Mapping:
Parent/child vulnerability relationships
Full ancestor/descendant hierarchies
View-filtered relationship analysis
Automatic Normalization: Handles CWE IDs with or without "CWE-" prefix
Zero Configuration: No authentication required for MITRE's public API
MCP Integration: Ready for stdio transport with MCP-compatible systems
Batch Processing: Retrieve multiple vulnerabilities in single requests
Implemented API Endpoints
The mcp implements the following MITRE CWE API endpoints:
Endpoint | Description |
| Get CWE content version information |
| Retrieve metadata for specified CWE ID(s) |
| Get weaknesses by ID(s) or all weaknesses |
| Retrieve categories by ID(s) or all categories |
| Get views by ID(s) or all views |
| Get parents of a weakness (view-filtered) |
| Get children of a weakness (view-filtered) |
| Get ancestors of a weakness (view-filtered) |
| Get descendants of a weakness (view-filtered) |
Getting Started
Prerequisites
Python 3.10+
uv package manager
Installation
Clone the repository:
git clone https://github.com/Bilel-Eljaamii/cwe-search_mcp.git cd cwe-search_mcpInstall dependencies:
pip install requests fast-mcp
Usage Guide
Standalone Execution
Run the mcp as a standalone module:
DANGEROUSLY_OMIT_AUTH=true mcp dev main.pyOutput:
[06/28/25 12:46:09] INFO Starting cwe-search_mcp
Starting MCP inspector...
โ Proxy server listening on 127.0.0.1:6277
โ WARNING: Authentication is disabled. This is not recommended.
New STDIO connection request
STDIO transport: command=/usr/bin/uv, args=run,--with,mcp,mcp,run,main.py
Created server transport
Created client transport
๐ MCP Inspec
MCP Client Integration
To integrate the CWE Search Service with your MCP client:
Locate Configuration: Open your MCP client configuration file
Update Path: Set CWE_SEARCH_SERVICE_PATH to the absolute path of your local installation directory
Add to your mcp client configuration file, modify the 3.
"CWE_SEARCH_SERVICE_PATH"as you self dir.
"cwe-search_mcp": {
"autoApprove": [],
"disabled": false,
"timeout": 60,
"type": "stdio",
"command": "uv",
"args": [
"--directory",
"CWE_SEARCH_SERVICE_PATH",
"run",
"main.py"
]
}AnythingLLM

Cline / VSCode

Key Notes
Authentication: No credentials required - MITRE's CWE API is publicly accessible
Input Normalization: MCP automatically handles CWE ID formats:
79โ Normalized to79CWE-79โ Normalized to79cwe79โ Normalized to79
Batch Processing: Comma-separated IDs supported for most endpoints
allKeyword: Retrieve all items for weakness, category, and view endpoints
Dependencies
requests - HTTP library for API communication
fastmcp - The fast, Pythonic way to build MCP servers and clients.
# Using uv (recommended)
uv init
uv venv
source ./venv/bin/activate
uv pip install "mcp[cli]" "requests"Contributing
We welcome contributions! Please follow these steps:
Fork the repository
Create your feature branch (
git checkout -b feature/your-feature)Commit your changes (
git commit -am 'Add some feature')Push to the branch (
git push origin feature/your-feature)Open a pull request
Please ensure your code follows PEP 8 style guidelines and includes appropriate tests.
License
This project is licensed under the MIT License - see the LICENSE file for details.
Acknowledgements & Resources
MITRE Corporation for maintaining the Common Weakness Enumeration database
Empower your vulnerability research with direct access to MITRE's CWE database through this lightweight, integration-ready MCP. Contribute, customize, and enhance your security workflows today!
Available Tools
9 toolsget_cwe_ancestorsA
Get ancestors of a specified CWE weakness, filtered by view and primary flag
Args: cwe_id: CWE ID (with/without 'CWE-') view: Optional view identifier to filter relationships primary: Limit ancestors to include only primary parents
Returns: Dictionary with "Ancestors" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | ||
| cwe_id | Yes | ||
| primary | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral transparency burden. It discloses the return format (dictionary with 'Ancestors' array or error info) and parameter effects, but does not explicitly state that this is a read-only operation or describe any potential side effects, error conditions, or access requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with a clear one-line summary followed by Args and Returns sections. Every sentence adds value without redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity (3 params, 1 required) and the presence of an output schema, the description covers the essential behavior and parameters. It could be more complete by mentioning usage relative to sibling tools, but it is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description fully compensates by explaining each parameter: cwe_id format, view as an optional filter, and primary as a way to limit to primary parents. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets ancestors of a CWE weakness, using a specific verb and resource. It distinguishes from siblings like get_cwe_children and get_cwe_parents by using 'ancestors' to indicate upward traversal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on the purpose and optional filters (view, primary), but does not explicitly mention alternatives or when not to use this tool. The sibling list implies alternatives, but no exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_categoryA
Get CWE categories by ID(s) or all categories
Args: ids: Comma-separated category IDs (with/without 'CWE-') or "all" Examples: "123", "CWE-456,789", "all"
Returns: Dictionary with "Categories" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses that IDs are accepted with or without the 'CWE-' prefix and that 'all' is a special value, and it notes the return shape ('Dictionary with Categories array or error information'). While it doesn't explicitly state read-only behavior, the verb 'get' implies it, and the error handling disclosure provides useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, with a single-sentence purpose followed by concise Args and Returns sections. Every line adds useful information, and the format is scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple getter with one parameter and an existing output schema, the description covers the core behavior and parameter semantics. It does not mention potential performance implications of 'all' or explicitly differentiate from sibling tools, but these are minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema defines only a bare string parameter, but the description thoroughly explains its semantics: comma-separated IDs, optional 'CWE-' prefix, and the special value 'all', with concrete examples. This far exceeds the schema's minimal information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Get CWE categories by ID(s) or all categories', clearly stating the action (get) and resource (CWE categories). This distinguishes it from sibling tools that target weaknesses, views, parents, or children.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when category data is needed, and the 'all' value suggests bulk retrieval. However, it does not explicitly mention when to use this tool over siblings like get_cwe_weakness or get_cwe_view, nor does it provide any exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_childrenA
Get children of a specified CWE weakness, filtered by view
Args: cwe_id: CWE ID (with/without 'CWE-') view: Optional view identifier to filter relationships
Returns: Dictionary with "Children" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | ||
| cwe_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return format ('Dictionary with Children array or error information') and mentions view filtering, but does not clarify whether results are direct-only, error conditions, or authentication requirements. This is adequate for a simple getter but not richer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose and followed by clear Args/Returns sections. Each sentence adds value without redundancy, maintaining a compact and organized structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity getter with an output schema, the description covers the essential purpose, parameters, and return format. The main gap is the lack of explicit usage guidance relative to similar siblings, but the tool definition is generally sufficient for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates by explaining both parameters: cwe_id can be with or without 'CWE-', and view is optional for filtering relationships. This adds meaningful context beyond the schema's basic string types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get children of a specified CWE weakness, filtered by view' with a specific verb and resource. It distinguishes from sibling tools like get_cwe_parents and get_cwe_descendants by using 'children' to indicate direct relationships.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving children of a CWE, but it does not explicitly mention when to use this tool over get_cwe_descendants or how view filtering should be applied. No alternatives or exclusions are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_content_versionA
Get CWE content version information Calls endpoint: GET /version
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only discloses that an HTTP GET endpoint is called, which implies a read-only operation, but it does not mention any potential caching, rate limits, or return format nuances. For such a simple tool, the lack of explicit behavioral disclosure is noticeable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the main purpose and followed by the endpoint reference. Every word contributes information, with no fluff or redundancy. It is an model of conciseness for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, output schema present), the description is sufficient. It states the primary function and the endpoint. Since an output schema exists, the description need not detail return values. Some might argue it could mention that version info is useful for compatibility checks, but that is not essential for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, and the baseline for 0 params is 4. The description adds the endpoint path, which provides some context for how the request is made, but it does not need to explain parameter meanings since there are none. It does not add much beyond the schemaless nature, but the baseline is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves CWE content version information, with a specific verb ('Get') and resource ('CWE content version'). It distinguishes itself from sibling tools by referring to the /version endpoint, making it evident this is for version data rather than weakness/category/view details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention scenarios such as checking the current CWE version before querying other data, nor does it name any sibling tools. The only context is the endpoint call, which is technical but not usage-oriented.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_descendantsA
Get descendants of a specified CWE weakness, filtered by view
Args: cwe_id: CWE ID (with/without 'CWE-') view: Optional view identifier to filter relationships
Returns: Dictionary with "Descendants" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | ||
| cwe_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the return format ('Dictionary with "Descendants" array') and the possibility of error information, which is useful. However, it does not explicitly clarify that 'descendants' means all reachable nodes recursively (as opposed to direct children), nor does it mention any pagination, ordering, or authentication requirements. It is adequate but leaves notable gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-sentence summary followed by Args and Returns sections. Every sentence provides necessary information, with no fluff or redundancy. The summary is front-loaded, making the tool's purpose immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is relatively simple with 2 parameters and an output schema, so the description covers the core aspects: purpose, basic parameter semantics, and return format. However, it lacks guidance on when to prefer this tool over similar sibling tools and does not elaborate on the 'view' concept, leaving the description somewhat incomplete for an agent needing to decide among relationship-based queries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so by explaining cwe_id as 'CWE ID (with/without 'CWE-')', adding formatting nuance beyond the schema's plain string type, and view as 'Optional view identifier to filter relationships', clarifying its purpose. This adds meaning to both parameters, though the view parameter could benefit from examples or valid values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Get descendants of a specified CWE weakness, filtered by view', providing a specific verb (get), resource (CWE weakness), and scope (descendants, filtered by view). This clearly distinguishes it from sibling tools like get_cwe_children, get_cwe_parents, and get_cwe_ancestors, which target different relationship types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It does not mention that get_cwe_children should be used for direct children, or that get_cwe_ancestors covers the inverse relationship. There are no explicit exclusions, prerequisites, or contextual hints about filter use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_infoA
Get metadata for specified CWE ID(s)
Args: ids: Comma-separated list of CWE IDs (with or without 'CWE-' prefix) Example: "79" or "CWE-79" or "79,89,CWE-22"
Returns: Dictionary with CWE metadata or error information
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden for behavior. It discloses that the tool returns a dictionary with metadata or error information, and it specifies the expected ID format. However, it does not mention potential error conditions, permissions, rate limits, or other behavioral traits beyond the basic read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and logically structured with an action line, an Args section, and a Returns section. Every sentence adds valueโthere is no filler or repetition, and the layout is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one parameter and an output schema, the description covers the input format and general return behavior sufficiently. It lacks explicit guidance on tool selection among siblings, but the level of detail is otherwise complete for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only the parameter name 'ids' and type 'string' with zero description. The description compensates thoroughly by explaining the comma-separated format, the optional 'CWE-' prefix, and providing concrete examples, making the parameter behavior completely clear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Get metadata') and a specific resource ('specified CWE ID(s)'). It is somewhat differentiated from sibling tools like get_cwe_weakness or get_cwe_category by its general 'metadata' scope, but does not explicitly name alternatives or clarify why this generic tool is preferable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings such as get_cwe_weakness, get_cwe_view, or get_cwe_parents. It simply states the function with no mention of context, prerequisites, or exclusions, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_parentsA
Get parents of a specified CWE weakness, filtered by view
Args: cwe_id: CWE ID (with/without 'CWE-') view: Optional view identifier to filter relationships
Returns: Dictionary with "Parents" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | ||
| cwe_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It does mention the return format ('Dictionary with "Parents" array or error information'), but it does not explicitly state that the operation is read-only, nor does it note any authentication, rate limits, or side effects. The implied read-only nature of 'Get' plus return information earns a mid-range score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the main purpose, followed by clear Args and Returns sections. Every sentence and parameter explanation adds value, with no redundant fluff. The structure makes it easy for an agent to quickly grasp the tool's behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a simple 2-parameter tool, an output schema present, and a description that covers the core functionality and return type, the description is largely complete. It lacks only a brief note on usage context or relationship to sibling tools, which would improve completeness but is not essential for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate entirely for parameter understanding. Both parameters are described with actionable details: cwe_id accepts 'with/without CWE-' and view is an optional 'view identifier to filter relationships.' This goes beyond the raw schema by explaining the input format and effect, fully covering the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get parents of a specified CWE weakness' with a specific verb and resource, and the 'filtered by view' qualifier adds additional scope. It effectively distinguishes this from sibling tools like get_cwe_children and get_cwe_ancestors by explicitly targeting parent relationships only.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives such as get_cwe_ancestors or get_cwe_children. There is no mention of exclusions or preferred use cases beyond the basic 'get parents' statement, leaving the agent to infer proper selection from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_viewA
Get CWE views by ID(s) or all views
Args: ids: Comma-separated view IDs (with/without 'CWE-') or "all" Examples: "1000", "CWE-1010,1020", "all"
Returns: Dictionary with "Views" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses the return structure (a dictionary with 'Views' array or error information) and provides input examples, which is useful. However, it does not mention side effects, authentication, rate limits, or other behavioral traits beyond the return format, so transparency is only partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct and well-structured, with a one-sentence summary upfront followed by clear Args and Returns sections. Every element is meaningful, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool with an output schema, the description covers the essential functionality, parameter format, and return shape. It would be more complete if it differentiated this from sibling tools, but the core operational details are fully specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides zero description for the 'ids' parameter, but the description compensates thoroughly. It specifies comma-separated IDs with or without the 'CWE-' prefix, including concrete examples like '1000', 'CWE-1010,1020', and 'all'. This is exactly the semantic detail needed for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs 'Get' on 'CWE views' with support for ID(s) or all views. This distinguishes it from sibling tools like get_cwe_weakness and get_cwe_category, which operate on different CWE entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the input format (IDs or 'all') but gives no explicit guidance on when to use this tool versus siblings like get_cwe_info or get_cwe_weakness. It lacks any exclusions or alternative tool mentions, leaving usage context to be inferred from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cwe_weaknessA
Get CWE weaknesses by ID(s) or all weaknesses
Args: ids: Comma-separated CWE IDs or "all" to retrieve all weaknesses Examples: "79", "CWE-89,125", "all"
Returns: Dictionary with "Weaknesses" array or error information
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the transparency burden. It discloses that the return is a dictionary with a 'Weaknesses' array or error information and documents accepted input formats. However, it does not address permissions, rate limits, or behavior on invalid IDs beyond returning an error.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with a one-sentence summary, followed by clearly labeled Args and Returns sections. Every element adds useful information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter retrieval tool with an output schema, the description covers the input format, return shape, and error possibility. It lacks explicit usage boundaries relative to sibling tools, but it is otherwise sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only defines ids as a required string, but the description adds essential semantics: comma-separated CWE IDs, the special value 'all', and concrete example formats like 'CWE-89,125'. This fully compensates for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' with a clear resource 'CWE weaknesses' and scopes it by ID(s) or all. This distinguishes it from sibling tools for categories, views, parents, descendants, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by saying it retrieves weaknesses by IDs or all, but it does not explicitly state when to prefer this over get_cwe_info or other siblings, nor does it provide exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.1.0- First observed
get_cwe_ancestors - First observed
get_cwe_category - First observed
get_cwe_children - First observed
get_cwe_content_version - First observed
get_cwe_descendants - First observed
get_cwe_info - First observed
get_cwe_parents - First observed
get_cwe_view - First observed
get_cwe_weakness
TDQS
Scored across 9 tools
Each tool targets a distinct aspect of CWE data: version, metadata, weakness, category, view, and specific relationship directions (parents, children, descendants, ancestors). There is minor overlap between get_cwe_info and get_cwe_weakness, but their scopes differ (metadata vs full weakness details).
All tools consistently use the 'get_cwe_' prefix followed by a specific noun or relationship, forming a clear and predictable verb_noun pattern. The naming convention is uniform across the entire set.
With 9 tools, the server is well-scoped for a CWE lookup and traversal service. Each tool serves a clear purpose without redundancy or bloat, covering all major CWE resource types and relationship queries.
The server provides comprehensive coverage for CWE retrieval: metadata, weaknesses, categories, views, and all four relationship directions (parents, children, ancestors, descendants). The main gap is the lack of a keyword-based search, but the core ID- and relationship-based workflows are fully supported.
Maintenance
Related MCP Connectors
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
NVD MCP โ wraps the NIST National Vulnerability Database API (free, no auth)
ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.5MIT
- AlicenseNot gradedqualityDmaintenanceEnables searching the NIST NVD for CVEs, retrieving full CVE details, checking software for known vulnerabilities, and searching the CPE database.MIT
- AlicenseAqualityAmaintenanceEnables querying the WPScan API for WordPress plugin, theme, core vulnerabilities, and specific vulnerability lookups through MCP tools.46 npmMIT
- FlicenseAqualityBmaintenanceEnables querying and analyzing a legacy, file-based vulnerability registry via MCP tools for CVE lookup, search, vendor navigation, and aggregate statistics.5-