MCP server directory

nist-nvd-mcp-server

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

Version:: hosted
Publisher:: cyanheads

Install

Generated from the server’s transport data — never hand-written. Placeholders in angle brackets are yours to fill.

Run it with its own identity, a budget you set, and every call audited — no local config to keep in sync.

Add to a connect0 project

You will sign in first, then land back on this page.

What it can do

As declared by the publisher

Tools · 5

nvd_audit_cpe
Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. Use nvd\_search\_cpes first to resolve the correct CPE string for a product. Returns full CVE records.
nvd_get_cve
Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, and references. Up to 100 CVE IDs per call. For bulk lookups of more than 10 IDs, use brief: true — full records for 100 CVEs can exceed 1MB and exhaust context budgets.
nvd_get_cve_history
Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. For the current record, call nvd\_get\_cve instead. The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD\_API\_KEY for reliable operation.
nvd_search_cpes
Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd\_audit\_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http\_server:2.4.51:*:*:*:*:*:*:\*) and must match exactly to audit the right product.
nvd_search_cves
Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in queryMeta. Returns brief summaries — call nvd\_get\_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).