CVE-info-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CVE_INFO_DATA_URL | No | 配信元データ URL。`--data-url HTTPS_URL` でも指定可能。 | |
| CVE_INFO_CACHE_DIR | No | 変更可能なキャッシュ保存先。未指定時は OS 標準のユーザーキャッシュ。`--cache-dir PATH` でも指定可能。 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| searchA | Search CVE IDs, products, Japanese keywords or CWEs. Returns up to 20 results with citation URLs; use fetch for details. |
| fetchA | Fetch one CVE by its exact ID, including official data, AI explanation, research and source URLs. |
| search_cvesA | Filter and paginate CVEs, newest publication first. Limit 1..50; offset <= 10000. Search is literal, not semantic. |
| get_cveB | Fetch all or one section: official, ai, research. Increase max_characters up to 50000 for truncated records. |
| get_statusA | Return local index freshness, dataset version, coverage and source collection-status URL. Does not trigger a download. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
The set contains two overlapping search tools (`search` vs `search_cves`) and two overlapping detail tools (`fetch` vs `get_cve`). Descriptions hint at differences in pagination and section selection, but an agent could easily choose the wrong one for a simple CVE lookup.
Names mix bare verbs (`search`, `fetch`) with verb_noun patterns (`search_cves`, `get_cve`, `get_status`). The same action is labeled both `fetch` and `get_cve`, making the convention inconsistent rather than predictable.
Five tools is a reasonable count for a CVE lookup server, but the redundancy between the two search tools and the two retrieval tools means not every tool clearly earns its place. Consolidating the pairs would yield a cleaner three-tool surface.
The server covers the core read-only CVE lifecycle: search, filtered pagination, detailed retrieval by ID, section selection, and index status. Minor gaps exist around related metadata such as CWE or product browsing, but the main workflows are supported.