cve-search_mcp

by roadwy

Overview Schema Related Servers Score Discussions

Python

Remote

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.0
Disambiguation5/5
Each tool has a clearly distinct purpose targeting specific CVE-related queries: searching by ID, checking database status, retrieving recent CVEs, finding vulnerabilities by vendor/product, listing products per vendor, and listing all vendors. There is no overlap in functionality, making tool selection unambiguous.
Naming Consistency5/5
All tools follow a consistent 'vul_' prefix and snake_case naming pattern (e.g., vul_cve_search, vul_vendor_products), with clear and descriptive names that indicate the resource and action. This uniformity enhances readability and predictability.
Tool Count5/5
With 6 tools, the server is well-scoped for CVE search and vulnerability management, covering key operations like lookup, updates, recent entries, and vendor/product queries. Each tool serves a specific, non-redundant purpose, making the count appropriate for the domain.
Completeness4/5
The tool set provides comprehensive coverage for querying CVE data, including searches by ID, vendor, product, and recent entries, plus database status. A minor gap is the lack of tools for filtering or sorting beyond basic queries, but core workflows are fully supported without dead ends.
Average 2.7/5 across 6 of 6 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
This repository includes a glama.json configuration file.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It vaguely indicates a read operation ('get more information') but doesn't specify what 'more information' entails, whether it requires authentication, rate limits, or how it interacts with databases. This leaves significant gaps in understanding the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise but under-specified. It wastes no words, but the lack of detail means it doesn't fully earn its place. It could be more front-loaded with critical information, but it's not overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of database status tools, no annotations, and no output schema, the description is incomplete. It doesn't explain what 'more information' includes, the format of the response, or how it relates to sibling tools. This leaves the agent with insufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema description coverage is 100%, so there are no parameters to document. The description doesn't need to add parameter semantics, and it appropriately avoids mentioning any. This meets the baseline for a parameterless tool, though it doesn't exceed expectations by explaining implicit inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'To get more information about the current databases in use and when it was updated' restates the tool name 'vul_db_update_status' in different words, making it tautological. It doesn't specify a clear action verb beyond 'get information' or distinguish this tool from its siblings like 'vul_last_cves' or 'vul_vendors', which might also provide database-related information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. It doesn't mention alternatives, prerequisites, or specific contexts for usage, leaving the agent to infer based on the tool name alone. This lack of explicit direction reduces its utility in tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns JSON and filters by vendor and product, but lacks critical behavioral details such as whether it's a read-only operation, potential rate limits, authentication needs, error handling, or what the JSON structure includes. For a tool with no annotations, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and efficient, with no wasted words. It directly states the tool's function. However, it could be slightly more structured by explicitly naming the tool or separating key points, but it earns high marks for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (a tool with 2 parameters, no annotations, and no output schema), the description is incomplete. It doesn't explain the return values beyond 'JSON', lacks details on error cases or usage limits, and doesn't differentiate from siblings. For a vulnerability lookup tool, more context on data freshness, scope, or format is needed to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'vendor and a specific product', which aligns with the two parameters, but adds minimal meaning beyond their names. It doesn't explain what constitutes a valid vendor or product, provide examples, or detail how they interact (e.g., product must belong to vendor). This is insufficient given the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the purpose ('get a JSON with all the vulnerabilities per vendor and a specific product'), which is clear but vague. It specifies the action ('get') and resource ('vulnerabilities'), but doesn't distinguish it from siblings like 'vul_cve_search' or 'vul_vendor_products', and the phrase 'per vendor and a specific product' could be interpreted as filtering by both vendor and product, which is accurate but not explicitly differentiated from other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention siblings like 'vul_vendor_products' (which might list products for a vendor) or 'vul_cve_search' (which might search CVE details), nor does it specify prerequisites or exclusions. Usage is implied by the parameters but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool returns JSON for a specific CVE ID, but doesn't describe behavioral traits like error handling (e.g., for invalid IDs), rate limits, authentication needs, or whether it's a read-only operation. The description is minimal and lacks essential context for safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence that directly states the tool's function. It's front-loaded with the core purpose and wastes no words. Every part of the sentence earns its place by conveying the essential action and target, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a search operation with 1 parameter), lack of annotations, no output schema, and 0% schema coverage, the description is incomplete. It doesn't cover return values, error cases, or behavioral nuances. The description is too minimal to provide adequate context for an AI agent to use the tool effectively without additional assumptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the input schema. Schema description coverage is 0%, and the description doesn't explain the 'cve_id' parameter (e.g., format like 'CVE-2024-12345', examples, or constraints). With 1 parameter and low coverage, the description fails to compensate, leaving the parameter's semantics unclear beyond what the schema's title ('Cve Id') provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the purpose ('get a JSON of a specific CVE ID'), which is clear but vague. It specifies the verb 'get' and resource 'CVE ID', but doesn't distinguish from siblings like 'vul_last_cves' (which might get multiple CVEs) or 'vul_vendor_product_cve' (which might filter by vendor/product). The purpose is understandable but lacks specificity about what 'get' entails (e.g., retrieve details, fetch data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description doesn't mention siblings like 'vul_last_cves' for recent CVEs or 'vul_vendor_product_cve' for vendor/product-specific searches. There's no context on prerequisites, such as needing a valid CVE ID format. Usage is implied only by the tool name and description, with no explicit when/when-not instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool returns JSON with specific expansions (CAPEC, CWE, CPE), but lacks details on permissions, rate limits, error handling, or whether it's a read-only operation. For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the key information: purpose, parameter role, and output format. There is no wasted text, and it directly communicates the essential details without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (retrieving CVEs with expansions), lack of annotations, no output schema, and low parameter schema coverage, the description is insufficient. It doesn't explain the structure of the returned JSON, error conditions, or how expansions are handled. For a tool with no structured support, more context is needed to be complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds some meaning beyond the input schema, which has 0% coverage. It explains that the 'number' parameter controls how many CVEs to retrieve and specifies a default of 5. However, it doesn't detail constraints (e.g., min/max values) or format expectations. With low schema coverage, this provides basic but incomplete compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'To get a JSON of the last <number> CVEs including CAPEC, CWE and CPE expansions.' It specifies the verb ('get'), resource ('CVEs'), and scope ('last <number>'), though it doesn't explicitly differentiate from sibling tools like 'vul_cve_search' or 'vul_vendor_product_cve'. This makes it clear but not fully sibling-distinctive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions the default number (5) but doesn't indicate scenarios where this tool is preferred over siblings like 'vul_cve_search' or 'vul_vendor_product_cve'. There is no mention of prerequisites, exclusions, or comparative use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states it 'gets a JSON' but doesn't describe any behavioral traits such as whether it's a read-only operation, requires authentication, has rate limits, or what happens on errors. This leaves significant gaps for a tool that interacts with vulnerability data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's function without unnecessary words. It's appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of vulnerability data, no annotations, no output schema, and minimal parameter semantics, the description is incomplete. It doesn't address key aspects like the JSON structure, error handling, or how it fits with sibling tools, leaving the agent under-informed for reliable use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 1 parameter with 0% description coverage, so the schema provides no semantic context. The description adds minimal value by implying the parameter is a 'vendor', but doesn't explain what constitutes a valid vendor (e.g., format, examples, or relationship to other tools). This is a baseline score given the schema's lack of detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('get a JSON') and resource ('products associated to a vendor'), making the purpose understandable. However, it doesn't differentiate from sibling tools like 'vul_vendor_product_cve' or 'vul_vendors', which likely have related functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'vul_vendors' (which might list vendors) or 'vul_vendor_product_cve' (which might handle CVEs for vendor products), leaving the agent with no context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the output format ('JSON') but doesn't describe other traits like whether this is a read-only operation, if it requires authentication, rate limits, or what happens on errors. For a tool with zero annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise ('To get a JSON with all the vendors'), consisting of a single sentence that directly states the purpose. It's front-loaded and wastes no words, though it could be slightly more informative without losing efficiency. The brevity is appropriate for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema, no annotations), the description is minimally adequate. It covers the basic purpose and output format, but lacks details on usage context, behavioral traits, or how it fits with sibling tools. For a tool in a vulnerability context, more guidance on when to use it would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema description coverage is 100%, so there's no need for parameter details in the description. The description correctly doesn't mention any parameters, which is appropriate. It adds value by specifying the output format ('JSON'), which isn't covered by the schema, earning a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool's purpose ('get a JSON with all the vendors'), which is a clear verb+resource combination. However, it doesn't distinguish this from sibling tools like 'vul_vendor_products' or 'vul_vendor_product_cve', leaving ambiguity about scope. The purpose is understandable but lacks specificity about what 'vendors' means in this context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With sibling tools like 'vul_vendor_products' and 'vul_vendor_product_cve', there's no indication of whether this tool is for listing vendors only, while others might filter by products or CVEs. The lack of context makes it hard for an agent to choose appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![cve-search_mcp MCP server](https://glama.ai/mcp/servers/roadwy/cve-search_mcp/badges/card.svg)](https://glama.ai/mcp/servers/roadwy/cve-search_mcp)

Score Badge

Copy to your README.md:

[![cve-search_mcp MCP server](https://glama.ai/mcp/servers/roadwy/cve-search_mcp/badges/score.svg)](https://glama.ai/mcp/servers/roadwy/cve-search_mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/roadwy/cve-search_mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server