Collects CVE reference information from the GitHub Advisory Database as one of its data sources.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@cve-reference-mcp What references are available for CVE-2021-44228?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CVE ID를 입력받아 CVE 안내서 작성에 필요한 참고자료 목록을 수집·반환하는 MCP 서버입니다.
데이터 원본(NVD, CIRCL, OSV, EPSS, GitHub Advisory) 및 반환 참고자료의 상세 목록은 AGENTS.md § 1. MCP 서버 개요를 참조하세요.
별도 설치 없이 GitHub에서 바로 실행할 수 있습니다.
# npx
npx -y github:ch201y00n/cve-mcp
# pnpm
pnpm dlx github:ch201y00n/cve-mcpNode.js 18 이상이 필요합니다 (global
fetchAPI 사용).
Related MCP server: CVE Intelligence MCP Server
git clone https://github.com/ch201y00n/cve-mcp.git
cd cve-mcp
npm install~/Library/Application Support/Claude/claude_desktop_config.json (macOS) 또는
%APPDATA%\Claude\claude_desktop_config.json (Windows) 에 추가:
{
"mcpServers": {
"cve-reference-mcp": {
"command": "npx",
"args": ["-y", "github:ch201y00n/cve-mcp"],
"env": {
"GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxx"
}
}
}
}또는 로컬 설치 후 직접 경로를 지정:
{
"mcpServers": {
"cve-reference-mcp": {
"command": "node",
"args": ["/ABSOLUTE/PATH/TO/cve-mcp/src/index.mjs"],
"env": {
"GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxx"
}
}
}
}.cursor/mcp.json 에 추가:
{
"mcpServers": {
"cve-reference-mcp": {
"command": "npx",
"args": ["-y", "github:ch201y00n/cve-mcp"],
"env": {
"GITHUB_TOKEN": "ghp_xxxxxxxxxxxxxxxxxx"
}
}
}
}
GITHUB_TOKEN은 선택 사항이지만 있으면 GitHub Advisory 수집 Rate Limit이 60→5,000/시간으로 증가합니다.
get_cve_referencesCVE 안내서용 참고자료를 전체 수집합니다.
파라미터 | 타입 | 기본값 | 설명 |
| string | (필수) | 예: |
|
|
| 출력 형식 |
| string[] | 전체 | 수집할 원본 선택 |
get_cve_summaryNVD + EPSS 기반 핵심 정보만 간략 요약합니다.
파라미터 | 타입 | 기본값 | 설명 |
| string | (필수) | 예: |
파라미터 상세 설명, 실제 출력 예시, 테스트 방법은 docs/GUIDE.md 를 참조하세요.
CVE ID를 입력받아 CVE 안내서 작성용 참고자료 목록을 반환합니다. NVD, CIRCL, OSV, EPSS, GitHub Advisory 등 복수 원본에서 수집합니다.
Inputs: cve_id (required), sources, output_format.
CVE ID의 핵심 정보만 요약하여 반환합니다. (NVD + EPSS 기반 간략 요약)
Inputs: cve_id (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 2 tools
Both tools accept a CVE ID, but their purposes are clearly differentiated: one returns a list of references from multiple sources, and the other returns a concise summary of key information. While an agent must read the descriptions to choose correctly, there is no overlap in output type.
Both tool names follow a consistent get_cve_<noun> pattern, with 'references' and 'summary' clearly indicating their distinct functions. This is a uniform and predictable naming convention.
With only two tools, the set feels thin for a server dedicated to CVE references. However, it is narrowly scoped and may be adequate for the intended use case of gathering references and summaries for CVE guides.
The server covers two core operations: fetching references and providing summaries. Notable gaps exist, such as fetching detailed CVE metadata or searching by keyword, which an agent might expect from a CVE reference tool. Still, the provided tools cover the primary workflow without dead ends.
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations.
CVE lookup via NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK. 7 tools.
CVE triage in one call: NVD, CVSS, CISA KEV, EPSS, public exploits and an explained risk score.
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
