nist-mcp gives AI assistants structured access to NIST cybersecurity data and live NVD vulnerability information.
š NIST Publications
Search across SP 800, FIPS, IR, CSWP, and AI series by keyword, series, status, or type
Retrieve full metadata (abstract, authors, supersedes chains, supplemental materials)
Read publication content as Markdown (PDF, XLSX, CSV, JSON, XML); specify page ranges or sections
Download documents to local cache; resolve any publication ID to its latest revision
š SP 800-53 Rev 5 Controls
Search by keyword, family (AC, IA, SC, etc.), or baseline (LOW/MODERATE/HIGH)
Get full control details: statement, guidance, parameters, related controls, and enhancements
šļø CSF 2.0 Framework
Browse/search functions, categories, and subcategories with mapped SP 800-53 control counts
Cross-reference SP 800-53 controls and CSF categories bidirectionally
š Glossary
Look up NIST cybersecurity/privacy terms by exact match or keyword, with definitions and authoritative sources
š CMVP (Cryptographic Module Validation)
Search FIPS 140-2/3 validated modules by vendor, module name, algorithm, FIPS level, or validation status
ā NCP Security Checklists
Find configuration checklists by product, format (XCCDF, OVAL, PDF), or authority (DISA, CIS, NIST)
š· NICE Framework Work Roles
Search cybersecurity work roles by keyword or category (e.g., Analyze, Investigate, Protect and Defend)
š”ļø Live NVD CVE & CPE Data
Search CVEs by keyword, CVSS severity, CPE product, CWE type, date range, or CISA KEV status
Get full CVE details: CVSS scores, affected products, CWE classification, references, KEV status, and change history
Search the CPE database for products and platforms
š Cross-Domain & Utility
Search across ALL NIST data types simultaneously with one tool
Check local database freshness and trigger manual rebuilds from NIST sources
Data is cached locally and persists across sessions
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@nist-mcp What are the NIST SP 800-53 controls for multi-factor authentication?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A small Model Context Protocol (MCP) server that gives AI assistants structured access to the NIST cybersecurity catalog: publications, SP 800-53 Rev 5 controls, CSF 2.0, CMVP modules, NCP checklists, glossary terms, NICE work roles, and live NVD CVE/CPE data. Local NIST data is served from a SQLite index that builds automatically on first use by downloading structured data directly from NIST.
Install directly from GitHub:
pipx install git+https://github.com/ball2jh/nist-mcp.git
# or
pip install git+https://github.com/ball2jh/nist-mcp.gitFor local development:
git clone https://github.com/ball2jh/nist-mcp.git
cd nist-mcp
pip install -e ".[dev,scraper]"Related MCP server: NIST NVD MCP Server
Variable | Default | Description |
|
| Directory for the local database and cached documents |
| (none) | Optional NVD API key for higher rate limits (recommended) |
|
| Seconds between background database rebuilds (default: 7 days) |
Create ~/.nist-mcp/config.toml (or $NIST_MCP_DATA_DIR/config.toml) for persistent settings:
nvd_api_key = "your-api-key-here"
update_interval = 43200 # 12 hoursEnvironment variables take precedence over the config file.
Add to your MCP client's server list (e.g. Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"nist": {
"command": "nist-mcp",
"env": {
"NIST_MCP_NVD_API_KEY": "your-api-key-here"
}
}
}
}On first run, the server builds a local database by downloading structured data from NIST (~2 seconds). The database is cached and rebuilt automatically when stale (default: every 7 days).
This server is intended to run as a local stdio MCP server. It does not expose an HTTP listener, so access is limited to the MCP client process that launches it. Logs are written through Python logging, which writes to stderr by default and does not corrupt stdio JSON-RPC traffic.
Tool schemas constrain common option sets and result sizes. Document downloads are limited to HTTPS URLs from known NIST publication hosts, redirects are revalidated, filenames are sanitized before writing to the local cache, and page extraction is capped at 50 pages per request. Tools that download, cache, or rebuild local data are annotated as non-destructive but not purely read-only so clients can present appropriate confirmation UI.
Tool | Description |
| Search local NIST catalog data across publications, controls, CSF, glossary, CMVP, checklists, and NICE |
| Fetch a single local NIST record by source and ID |
| Download/cache and read publication content as Markdown; returns a PDF TOC by default |
| Search live NVD CVE or CPE data |
| Fetch one CVE with CVSS, weaknesses, references, KEV status, and optional change history |
| Show database build date, size, freshness, and file path |
| Rebuild the local NIST index by downloading fresh data from NIST sources |
URI | Description |
| Server version, database freshness, and quick-start tool guide |
search_nist("zero trust architecture")search_nist("zero trust", source="publications")
get_nist_record(source="publications", record_id="SP.800-207")search_nist("account management", source="controls", detail="standard")
get_nist_record(source="controls", record_id="AC-2")get_cve("CVE-2021-44228")search_nist("OpenSSL", source="cmvp")search_nist("incident response", source="csf")MIT license. Note that pymupdf4llm, used for PDF-to-Markdown conversion, is licensed under AGPL-3.0.
Show the current NIST metadata index status: build date, last update check, database size, and file path. Use this to verify the database is available and check data freshness.
Inputs: no named parameters. Returns: result
Download a publication PDF or supplemental material to local cache. Returns the file path. Use material_index to download a specific supplemental file listed in the get_publication output.
Inputs: publication_id (required), material_index. Returns: result
Get complete details for a specific SP 800-53 Rev 5 control: statement, guidance, parameters, related controls, baselines, and cross-framework mappings.
Set include_enhancements=True to also get all enhancement sub-controls. Do NOT use this for searching -- use search_controls to find controls first.
Inputs: control_id (required), include_enhancements. Returns: result
Browse/search the NIST CSF 2.0 framework hierarchy. No args = list all 6 functions. function="PR" = Protect categories. category="PR.AC" = subcategories. query="risk" = full-text search. Includes count of mapped SP 800-53 controls per entry.
Inputs: function, category, query, detail_level. Returns: result
Get full details for a CVE: description, CVSS scores, affected products (CPE), CWE classification, references, and CISA KEV status (if exploited: date added, due date, required action). Use this after search_cves to get complete vulnerability details. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: cve_id (required). Returns: result
Get the change history for a CVE ā when it was modified, what changed (score updates, CPE additions, CWE remaps). May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: cve_id (required). Returns: result
Retrieve publication content as Markdown. Without section/pages, returns table of contents. With section, returns that section. With pages, returns those pages. Handles PDF, XLSX, CSV, JSON, and XML formats. Results are cached locally.
Use this to read the actual content of NIST documents. For large documents like SP 800-53 (492 pages), use the pages parameter to request specific page ranges.
Inputs: publication_id (required), section, pages. Returns: result
Cross-reference frameworks. 'What CSF maps to AC-1?' or 'What 800-53 controls implement PR.AC?' Bidirectional lookup in the mappings table.
Inputs: source_id (required), target_framework. Returns: result
Resolve any publication to its newest available revision. Follows the supersedes chain. Use this when you need the most current version of a document.
Inputs: publication_id (required). Returns: result
Get full metadata for a specific NIST publication including title, abstract, authors, date, supersedes chain, related publications, and list of supplemental materials.
Inputs: publication_id (required). Returns: result
Look up NIST cybersecurity/privacy terms. Use 'term' for exact match, 'query' for keyword search. Returns definition, authoritative source, and related terms.
Inputs: term, query, limit. Returns: result
Search NCP security configuration checklists. 'SCAP checklists for Windows Server 2022' or 'CIS benchmarks for Ubuntu'.
Inputs: product, format, authority, query, +2 more. Returns: result
Search FIPS 140-2/3 validated cryptographic modules. 'Is OpenSSL FIPS validated?' or 'Which modules support AES-256-GCM at Level 2?'
Inputs: vendor, module_name, fips_level, algorithm, +3 more. Returns: result
Search NIST SP 800-53 Rev 5 security and privacy controls by keyword, family, or baseline. Accepts flexible ID formats (AC-2, ac-2, AC2 all work).
summary: label + title (~50 tokens/result) standard: + statement text + baselines (~200 tokens/result) full: + guidance + parameters + related controls (~500+ tokens/result)
Use get_control for the complete detail of a specific control including enhancements.
Inputs: query, family, baseline, include_withdrawn, +3 more. Returns: result
Search the NVD CPE (Common Platform Enumeration) database for products and platforms. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: keyword, match_string, limit, offset. Returns: result
Search the NVD CVE database. Supports keyword, CVSS severity, CPE product, CWE weakness type, and date range filters. Set has_kev=True for only CISA Known Exploited Vulnerabilities. Results include CVE ID, description, severity, and score. May take 6+ seconds without an NVD API key due to rate limiting.
Inputs: keyword, severity, cpe_name, cwe_id, +5 more. Returns: result
Search NICE Framework work roles. 'What role handles incident response?'
Inputs: query, category, limit. Returns: result
Search across ALL NIST data: publications, SP 800-53 controls, CSF framework, glossary, CMVP modules, checklists, and NICE roles. Results grouped by type.
Use this as a starting point when you're not sure which specific tool to use. For targeted searches, use domain-specific tools (search_publications, search_controls, etc.).
scope options: publications, controls, csf, glossary, cmvp, checklists, nice
Inputs: query (required), scope, limit. Returns: result
Search NIST publications by keyword across all series (SP 800, SP 1800, FIPS, IR, CSWP, AI).
Returns matching publications with ID, title, date, and series. Use get_publication for full details on a specific publication. Default shows only the latest revision of each document. Do NOT use this for SP 800-53 security controls -- use search_controls instead.
Inputs: query (required), series, status, pub_type, +4 more. Returns: result
Rebuild the NIST metadata index by downloading fresh data from NIST sources (XLSX, JSON, ZIP). Takes about 5-10 seconds. Use this if you need the most current publication or control data.
Inputs: no named parameters. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelogā¦
Scored across 20 tools
Most tools have distinct purposes with clear boundaries, such as get_control for detailed control information versus search_controls for finding controls. However, some overlap exists between search_nist and domain-specific search tools, which could cause confusion about which to use first, though descriptions help clarify their roles.
Tool names follow a highly consistent verb_noun pattern throughout, such as get_control, search_cves, and update_database. This predictability makes it easy for agents to understand and navigate the toolset without naming confusion.
With 20 tools, the count is slightly high but reasonable for the broad scope of NIST cybersecurity data, covering publications, controls, vulnerabilities, and frameworks. It might feel heavy, but each tool appears to serve a specific function without obvious redundancy.
The toolset provides comprehensive coverage for the NIST cybersecurity domain, including CRUD-like operations (e.g., get, search, update), cross-referencing, and content retrieval. No significant gaps are apparent, supporting full agent workflows from discovery to detailed analysis.
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
