# HaroldFinchIFT/vuln-nist-mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/HaroldFinchIFT/vuln-nist-mcp-server  
**GitHub Stars:** 14  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/haroldfinchift-vuln-nist-mcp-server

## Description
A Model Context Protocol (MCP) server for querying NIST National Vulnerability Database (NVD) API endpoints.

## Tools
Capabilities this server exposes over MCP:

- **USAGE** — Call this tool FIRST when user asks time-relative questions

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/HaroldFinchIFT/vuln-nist-mcp-server), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
git clone https://github.com/HaroldFinchIFT/vuln-nist-mcp-server
```

2. Run:

```sh
cd vuln-nist-mcp-server
```

3. Install:

```sh
docker build -t vuln-nist-mcp-server .
```

4. Start the server:

```sh
docker run --rm -it vuln-nist-mcp-server
```

## Documentation

## What HaroldFinchIFT/vuln-nist-mcp-server MCP server does

HaroldFinchIFT/vuln-nist-mcp-server MCP server provides an MCP interface to the NIST National Vulnerability Database (NVD) vulnerability API. It returns formatted text intended for consumption by language models and supports several common vulnerability research workflows: finding CVEs by keyword, retrieving one CVE, examining vulnerabilities associated with a product CPE, checking CISA Known Exploited Vulnerabilities (KEV) additions, and reviewing CVE change history.

The server uses public NVD endpoints and does not require an API key. It needs network access to the NVD service. Its output includes dates and references where those are part of the corresponding NVD response.

## How it works

The `get_temporal_context` tool supplies the current date and example date mappings for requests such as “this year,” “last year,” or “six months ago.” It should be called first for time-relative questions so a follow-up query can use explicit dates.

`search_cves` accepts a keyword and optional pagination and date parameters. Absolute `start_date` and `end_date` values take precedence over `last_days`; if neither is supplied, the search defaults to the most recent 30 days. The older `recent_days` parameter is deprecated. Results are ordered newest first.

Date ranges longer than 120 days for applicable NVD queries, or longer than 90 days for KEV queries, are divided into smaller requests and processed in parallel. The combined results are sorted chronologically. This can reduce the work required for broad searches, but large queries may still take longer than focused lookups.

## Setup and configuration

Docker is the recommended runtime. The documented flow is to clone the repository, build an image named `vuln-nist-mcp-server`, and run it interactively with Docker. Python 3.11 or newer is also listed as a prerequisite for non-Docker use, although the supplied quick start does not provide a separate Python launch command.

The HaroldFinchIFT/vuln-nist-mcp-server MCP server reads these optional environment variables:

- `NVD_BASE_URL` changes the API base URL; it defaults to `https://services.nvd.nist.gov/rest/json`.
- `NVD_VERSION` selects the API version path and defaults to `/2.0`.
- `NVD_API_TIMEOUT` sets the request timeout in seconds and defaults to `10`.

A client must be MCP-compatible, such as Claude Desktop. The host also needs network access to `services.nvd.nist.gov`.

## Tools and capabilities

- `get_cve_by_id` retrieves details, references, tags, and publication dates for a supplied CVE identifier.
- `cves_by_cpe` searches by a full CPE 2.3 name and can filter by whether the configuration is vulnerable. The server validates the CPE format.
- `kevs_between` finds CVEs added to the CISA KEV catalog between two dates, with pagination support.
- `cve_change_history` accepts either a CVE identifier or a change-date range and returns the matching history.
- `search_cves` supports result limits, offsets, relative day windows, and ISO-style absolute date ranges.

Input sanitization, date parsing, timeout handling, malformed-response handling, and API error handling are included. Diagnostic logging is written to stderr. The Docker configuration runs as a non-root user, and the project states that it does not persist sensitive data.

## Limitations and notes

Queries depend on availability of the public NVD endpoints and require outbound network access. The CPE search requires the complete CPE 2.3 format rather than a partial product name. Broad date queries are automatically split, but the number of requests can increase with the requested range. For relative time expressions, call the temporal-context tool before constructing the main query.

_Full upstream README: https://allmcps.com/mcp/haroldfinchift-vuln-nist-mcp-server/readme_