Nist Nvd Mcp Server

cyanheads/nist-nvd-mcp-server

Connects Claude to the NIST National Vulnerability Database API 2.0 for CVE research and CPE auditing. Exposes five tools: keyword search with severity and CWE filters, batch CVE lookup with full CVSS scoring across v2/v3/v4, CPE dictionary search, product version audit via exact CPE name or virtual match strings with version ranges, and CVE change history tracking. Built with token bucket rate limiting that respects NVD's 5 req/30s unauthenticated and 50 req/30s authenticated limits, automatic retry with backoff, and HTML response guards for their rate limit pages. Includes CISA KEV filtering for known exploited vulnerabilities. Useful for security audits, dependency scanning, and vulnerability surveillance workflows where you need structured access to official CVE data without writing your own NVD client.

GitHub stars: 1
tools: 5
transport: STDIO, HTTP
env vars: 9
last updated: Oct 26, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://nist-nvd.caseyjhand.com/mcp --name nist-nvd

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http nist-nvd https://nist-nvd.caseyjhand.com/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 5 tools

Verified live against the running server on Nov 6, 2026.

nvd_get_cveFetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, current SSVC assessments, and references. Up to 1...5 params

Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, current SSVC assessments, and references. Up to 1...

Parameters* required

allLanguagesboolean

When true, keeps every localized description NVD supplies on each record, and full records render all of them. Default keeps English only, falling back to whatever exists if a record has no English...default: false

briefboolean

When true, returns trimmed records (ID, status, top CVSS score, KEV name, published date, and a truncated description) instead of full detail. Recommended for batches of more than 10 IDs.default: false

cveIds*value

One CVE ID or an array of CVE IDs; at most 100 are fetched per call.

includeConfigurationsboolean

When false, omits configurationNodes from full records and their rendered text.default: true

includeReferencesboolean

When false, omits the references array to reduce response size.default: true

nvd_search_cvesSearch CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response...15 params

Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response...

Parameters* required

cweIdstring

Filter by CWE weakness ID (e.g., "CWE-79", "NVD-CWE-Other").

exactPhraseboolean

When true, keyword matches as an exact phrase rather than ANDing its words independently. Requires keyword.default: false

kevOnlyboolean

When true, filters results to CVEs in the CISA Known Exploited Vulnerabilities catalog.default: false

keywordstring

Full-text search across CVE descriptions (AND-semantics across words).

lastModDaysinteger

CVEs last modified in the last N days (max 120; values over 120 are clamped). Mutually exclusive with lastModStartDate/lastModEndDate.

lastModEndDatestring

ISO 8601 datetime for last-modified range end. Both required together.

lastModStartDatestring

ISO 8601 datetime for last-modified range start. Both required together. Mutually exclusive with lastModDays.

limitinteger

Maximum number of results to return (default 20; values above 2000 are clamped unless NVD_CLAMP_LIMITS is false).default: 20

noRejectedboolean

When true (default), excludes CVEs with REJECT/Rejected status.default: true

offsetinteger

Zero-based page offset for pagination.default: 0

pubDaysinteger

CVEs published in the last N days (max 120; values over 120 are clamped). Mutually exclusive with pubStartDate/pubEndDate.

pubEndDatestring

ISO 8601 datetime for publication range end. Both pubStartDate and pubEndDate required together.

pubStartDatestring

ISO 8601 datetime for publication range start. Both pubStartDate and pubEndDate required together. Mutually exclusive with pubDays.

severitystring

Filter to CVEs in exactly this CVSS severity band — NVD matches the one band, not a floor. Covering several bands (e.g. HIGH and CRITICAL) takes one call per band.one of LOW · MEDIUM · HIGH · CRITICAL

severityVersionstring

CVSS version to use for the severity filter. Default: v3 (maps to cvssV3Severity).one of v2 · v3 · v4default: v3

nvd_audit_cpeFind all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations whe...12 params

Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations whe...

Parameters* required

allLanguagesboolean

When true, keeps every localized description NVD supplies on each record. Default keeps English only.default: false

cpeNamestring

Full CPEv2.3 name (e.g., "cpe:2.3:a:apache:http_server:2.4.51:*:*:*:*:*:*:*"). NVD adds isVulnerable automatically. Mutually exclusive with virtualMatchString.

includeConfigurationsboolean

When false, omits configurationNodes from each record and its rendered text.default: true

includeReferencesboolean

When false, omits references from each record and its rendered text.default: true

limitinteger

Maximum number of CVEs to return (default 20; values above 2000 are clamped unless NVD_CLAMP_LIMITS is false).default: 20

offsetinteger

Zero-based page offset for pagination. Page through totalCount with a modest limit rather than raising limit — this tool returns full CVE records, so a large limit is a large response.default: 0

severityMinstring

Keep CVEs whose highest severity band across all CVSS versions meets this threshold, which can exceed the row headline severity. Applied after NVD returns the page, so only CVEs within limit are ev...one of LOW · MEDIUM · HIGH · CRITICAL

versionEndstring

Upper version bound. Requires virtualMatchString.

versionEndTypestring

Whether the upper version bound is inclusive or exclusive.one of including · excludingdefault: including

versionStartstring

Lower version bound. Requires virtualMatchString.

versionStartTypestring

Whether the lower version bound is inclusive or exclusive.one of including · excludingdefault: including

virtualMatchStringstring

Partial CPE match pattern (e.g., "cpe:2.3:a:apache:http_server:*"). Use with versionStart/versionEnd for version range audits. Mutually exclusive with cpeName.

nvd_search_cpesSearch the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifier...4 params

Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifier...

Parameters* required

cpeMatchStringstring

Partial CPEv2.3 pattern (e.g., "cpe:2.3:a:apache:http_server"). At least one of keyword or cpeMatchString is required.

keywordstring

Product name or vendor keyword (e.g., "apache http server", "openssl", "nginx"). At least one of keyword or cpeMatchString is required.

limitinteger

Maximum number of CPE entries to return (default 20; values above 10000 are clamped unless NVD_CLAMP_LIMITS is false).default: 20

offsetinteger

Zero-based page offset for pagination. When totalCount exceeds offset + returned, raise offset to reach the rest — a vendor-level keyword has nothing left to narrow toward.default: 0

nvd_get_cve_historyRetrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. Events are returned newest-f...4 params

Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. Events are returned newest-f...

Parameters* required

cveId*string

CVE identifier to retrieve history for (e.g., "CVE-2021-44228").

limitinteger

Maximum number of change events to return (default 20; values above 2000 are clamped unless NVD_CLAMP_LIMITS is false).default: 20

offsetinteger

Zero-based offset for paginating through change events, counted from whichever end order anchors to: offset 0 is the newest event under the default order="newest", and the oldest event under order=...default: 0

orderstring

Which end of the history to page from. Default "newest" returns the most recent events first, which is what escalation and re-score questions need. "oldest" returns NVD's native order (the CVE's fi...one of oldest · newestdefault: newest

Configuration

NVD_CLAMP_LIMITSdefault: true

Clamp oversized reads to 2000 CVEs/events, 10000 CPEs, or 100 CVE IDs. False restores rejection.

NVD_API_KEY

NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key.

NVD_REQUEST_TIMEOUT_MSdefault: 10000

Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key.

MCP_LOG_LEVELdefault: info

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

MCP_TRANSPORT_TYPEdefault: http

Selects the HTTP transport.

MCP_HTTP_HOSTdefault: 127.0.0.1

The hostname for the HTTP server.

MCP_HTTP_PORTdefault: 3010

The port to run the HTTP server on.

MCP_HTTP_ENDPOINT_PATHdefault: /mcp

The endpoint path for the MCP server.

MCP_AUTH_MODEdefault: none

Authentication mode to use: 'none', 'jwt', or 'oauth'.

Readme

@cyanheads/nist-nvd-mcp-server

Search and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database. STDIO or Streamable HTTP.

5 Tools • 2 Resources

View the full README on GitHub

Details

Repository: github.com/cyanheads/nist-nvd-mcp-server
Category: Search & Web Crawling
Package: @cyanheads/nist-nvd-mcp-server
Transport: STDIO, HTTP
Registry: MCP registry, active
Resources: 1
Tools verified: Nov 6, 2026

Related Search & Web Crawling MCP servers

View all

Usda Mcp Servercyanheads/usda-mcp-serverSearch foods, compare nutrients, and look up the full USDA FoodData Central database.1stars

Disney Lorcana MCPdanielenricocahall/lorcana-mcpMCP server for Disney Lorcana TCG: card search, deck validation, stats, and deck import/export1stars

Rollin Mcp Serverdavidsirota/rollin-mcp-serverWheelchair accessibility scores for 70,000+ US restaurants. Search, filter, and submit feedback.1stars

Tripitaka MCPdhamma-seeker/tripitaka-mcpMCP server for the full Pāli Canon — search, cite, compare translations. Offered as Dhamma Dāna.1stars

DocuPipedocupipe/docupipe-mcpUpload documents and extract structured JSON from Claude Code, Codex, Cursor and other MCP clients.1stars

Google Maps Placesdomdomegg/google-maps-places-mcpAllow AI systems to search for places and get business info via Google Maps Places API.1stars

Nist Nvd Mcp Server

Install

Tools

Configuration

Readme

@cyanheads/nist-nvd-mcp-server

Details

More from cyanheads

Related Search & Web Crawling MCP servers