CWE Search MCP

A Python-based interface to MITRE's Common Weakness Enumeration (CWE) database via the official API, enabling seamless vulnerability research and integration with MCP-compatible systems.

Overview

The CWE Search MCP provides a robust Python implementation for interacting with MITRE's Common Weakness Enumeration (CWE) database through its official API. Designed for security researchers, developers, and vulnerability analysts, this mcp enables efficient querying of vulnerability information and integrates seamlessly with MCP-compatible systems using stdio transport.

This solution solves the problem of fragmented vulnerability research by providing a unified interface to:

• Retrieve detailed CWE information programmatically

• Explore vulnerability relationships and hierarchies

• Integrate CWE data into security tooling and workflows

• Automate vulnerability analysis and reporting

Related MCP server: CVE-Search MCP Server

Key Features

• Comprehensive Vulnerability Lookup: Retrieve detailed information by CWE ID

• Intelligent Search: Find vulnerabilities by keyword across descriptions

• Taxonomy Navigation: Explore CWE categories and views

• Relationship Mapping:

  • Parent/child vulnerability relationships

  • Full ancestor/descendant hierarchies

  • View-filtered relationship analysis

• Automatic Normalization: Handles CWE IDs with or without "CWE-" prefix

• Zero Configuration: No authentication required for MITRE's public API

• MCP Integration: Ready for stdio transport with MCP-compatible systems

• Batch Processing: Retrieve multiple vulnerabilities in single requests

Implemented API Endpoints

The mcp implements the following MITRE CWE API endpoints:

Getting Started

Prerequisites

• Python 3.10+

• uv package manager

Installation

1. Clone the repository:

   git clone https://github.com/Bilel-Eljaamii/cwe-search_mcp.git
   cd cwe-search_mcp

2. Install dependencies:

   pip install requests fast-mcp

Usage Guide

Standalone Execution

Run the mcp as a standalone module:

DANGEROUSLY_OMIT_AUTH=true mcp dev main.py

Output:

[06/28/25 12:46:09] INFO     Starting cwe-search_mcp
Starting MCP inspector...
⚙ Proxy server listening on 127.0.0.1:6277
⚠  WARNING: Authentication is disabled. This is not recommended.
New STDIO connection request
STDIO transport: command=/usr/bin/uv, args=run,--with,mcp,mcp,run,main.py
Created server transport
Created client transport
🔍 MCP Inspec

MCP Client Integration

To integrate the CWE Search Service with your MCP client:

1. Locate Configuration: Open your MCP client configuration file

2. Update Path: Set CWE_SEARCH_SERVICE_PATH to the absolute path of your local installation directory

3. Add to your mcp client configuration file, modify the 3."CWE_SEARCH_SERVICE_PATH" as you self dir.

"cwe-search_mcp": {
  "autoApprove": [],
  "disabled": false,
  "timeout": 60,
  "type": "stdio",
  "command": "uv",
  "args": [
    "--directory",
    "CWE_SEARCH_SERVICE_PATH",
    "run",
    "main.py"
  ]
}

AnythingLLM

Cline / VSCode

Key Notes

• Authentication: No credentials required - MITRE's CWE API is publicly accessible

• Input Normalization: MCP automatically handles CWE ID formats:

  • 79 → Normalized to 79

  • CWE-79 → Normalized to 79

  • cwe79 → Normalized to 79

• Batch Processing: Comma-separated IDs supported for most endpoints

• all Keyword: Retrieve all items for weakness, category, and view endpoints

Dependencies

• requests - HTTP library for API communication

• fastmcp - The fast, Pythonic way to build MCP servers and clients.

# Using uv (recommended)
uv init
uv venv
source ./venv/bin/activate
uv pip install "mcp[cli]" "requests"

Contributing

We welcome contributions! Please follow these steps:

1. Fork the repository

2. Create your feature branch (git checkout -b feature/your-feature)

3. Commit your changes (git commit -am 'Add some feature')

4. Push to the branch (git push origin feature/your-feature)

5. Open a pull request

Please ensure your code follows PEP 8 style guidelines and includes appropriate tests.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgements & Resources

• MITRE Corporation for maintaining the Common Weakness Enumeration database

• Official CWE Website

• CWE API Documentation

• CWE List Version 4.14

Empower your vulnerability research with direct access to MITRE's CWE database through this lightweight, integration-ready MCP. Contribute, customize, and enhance your security workflows today!