Skip to main content
Glama
Sign In
cve-cache-mcp

cve-cache-mcp

by weiseer
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

@weiseer/cve-cache-mcp

Recent CVE + GHSA cache as a stdio MCP server.

Probe P-005 by weiseer.

What it does

Cached, structured snapshot of recent CVE + GitHub Security Advisory records — for AI agents auditing dependencies or screening new packages.

Your agent can:

  • lookup_cve — full record for one CVE/GHSA ID

  • find_for_package — all CVEs affecting a package by ecosystem (npm/PyPI/Cargo/Maven/Go)

  • list_recent_critical — recent high-severity CVEs (default: 7-day, CVSS ≥ 7)

  • severity_summary — counts by severity bucket

Related MCP server: Security Vulnerability MCP Server

Why use this instead of your agent querying NVD itself

Agent DIY

cve-cache

Source query

NVD JSON feeds + GHSA GraphQL

1 MCP call

Token cost (NVD records are large)

$0.05-0.20

$0 free / $0.00005 paid

Latency

2-10 seconds

<100ms

Cross-ecosystem normalization

Per-source schema

Pre-normalized

Install

npm install -g @weiseer/cve-cache-mcp

Use with Claude Desktop / Cursor / Cline / Continue / Windsurf

{
  "mcpServers": {
    "cve-cache": {
      "command": "npx",
      "args": ["-y", "@weiseer/cve-cache-mcp"]
    }
  }
}

License

Apache-2.0. Catalog data: derived from public CVE/NVD/GHSA feeds (CC0/public domain).

Available Tools

4 tools
find_for_packageA

All CVEs affecting a package. Optionally filter by ecosystem.

Inputs: package_name (required), ecosystem.

list_recent_criticalC

Recent CVEs with CVSS >= threshold. Default: 7-day high-severity feed.

Inputs: min_cvss, since_days.

lookup_cveA

Full record for one CVE by ID. Cited NVD + GHSA URLs.

Inputs: cve_id (required).

severity_summaryA

Counts by severity bucket across the snapshot. Quick agent triage view.

Inputs: no named parameters.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 4 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose: lookup by ID, search by package, list recent criticals, and severity summary. No overlap or ambiguity.

    Naming Consistency5/5

    All tool names follow a consistent verb_noun pattern in snake_case (lookup_cve, find_for_package, list_recent_critical, severity_summary).

    Tool Count4/5

    With 4 tools, the set is concise and covers core CVE operations without being too sparse or bloated. Slightly small but appropriate for the domain.

    Completeness4/5

    The surface covers lookup, package search, recent criticals, and severity summary. Missing features like ecosystem-specific search or filtering on lookup are minor gaps.

    Resources

    Related MCP Connectors

    Related MCP Servers

    • cve-lookup-mcp

      Aashish-32
      A
      license
      A
      quality
      D
      maintenance
      Provides live CVE data from NVD and EPSS without API key, enabling AI assistants to look up CVSS scores, search vulnerabilities, and check product CVEs.
      3
      MIT

    • vuln-intel-mcp

      rohanrajnist
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
      1
      MIT
    • Fetter MCP

      Fetter MCPofficial

      fetter-io
      F
      license
      Not graded
      quality
      D
      maintenance
      Provides real-time Python package vulnerability data, enabling AI agents to check CVEs, CVSS scores, and safe versions for informed dependency decisions.
      1
      -