# nist-nvd-mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/cyanheads/nist-nvd-mcp-server  
**GitHub Stars:** 2  
**npm Downloads (last month):** 1664  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nist-nvd-mcp-server

## Description
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

## Tools
Capabilities this server exposes over MCP:

- **nvd_search_cves** — Search CVEs by keyword, severity, CWE, date range, or CISA KEV status.
- **nvd_get_cve** — Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and references.
- **nvd_search_cpes** — Search the NVD CPE dictionary by product keyword or partial match string.
- **nvd_audit_cpe** — Find all CVEs affecting a specific product version by CPE name or virtual match string.
- **nvd_get_cve_history** — Retrieve the change history for a CVE — score revisions, status transitions, and reference additions.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `bunx` (confidence: high):

```json
"mcpServers": {
  "nist-nvd-mcp-server": {
    "command": "bunx",
    "args": ["@cyanheads/nist-nvd-mcp-server@latest"],
    "env": {
      "NVD_API_KEY": "",
      "NVD_CLAMP_LIMITS": "",
      "NVD_REQUEST_TIMEOUT_MS": ""
    }
  }
}
```

**Requires environment variables:** `NVD_API_KEY`, `NVD_CLAMP_LIMITS`, `NVD_REQUEST_TIMEOUT_MS` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What nist-nvd-mcp-server does

nist-nvd-mcp-server exposes NIST National Vulnerability Database data through MCP tools and resources. It covers both vulnerability records and the NVD CPE dictionary, allowing an agent to move from a product name to an exact CPE and then identify affected CVEs.

CVE searches can use keywords, severity bands, CWE identifiers, publication or modification dates, and CISA Known Exploited Vulnerabilities status. Individual lookups return CVSS data across supported versions, weaknesses, affected configurations, KEV fields, references, and optional SSVC assessments when NVD supplies them.

The server also publishes an `nvd://cve/{cveId}` JSON resource for a single CVE and a guide resource covering product applicability, identifier chains, severity interpretation, and coverage considerations.

## How it works

The server queries NVD through either STDIO or Streamable HTTP transport. Requests are paced according to NVD limits: keyless access is limited to five requests per 30 seconds, while access with an API key is limited to 50 requests per 30 seconds. Retries enter the same queue, and a rate-limit response can pause queued work until the NVD window resets.

Search and audit results support pagination. Oversized requests are clamped by default, with the requested and effective limits reported in the response. Batch CVE lookup validates identifiers, removes duplicates, and reports IDs that were not processed or returned.

## Setup and configuration

The package can be launched with `npx -y @cyanheads/nist-nvd-mcp-server` from an MCP client configuration. It can also be reached through the published Streamable HTTP endpoint at `https://nist-nvd.caseyjhand.com/mcp`.

Set `NVD_API_KEY` to use the higher NVD request budget and improve the performance of CVE history requests. `NVD_REQUEST_TIMEOUT_MS` controls the request timeout, which can be raised for slower history calls. Set `NVD_CLAMP_LIMITS=false` to disable the default oversized-request clamping and restore the advertised maximums; invalid zero, negative, and fractional limits remain rejected.

## Tools and capabilities

- `nvd_search_cves` searches by keyword, severity, CWE, date range, KEV status, and rejection status. Keyword matching uses AND semantics unless exact-phrase mode is selected.
- `nvd_get_cve` retrieves one or up to 100 CVEs, with full or brief output and optional references, configurations, and localized descriptions.
- `nvd_search_cpes` finds CPE entries by product keyword or partial CPE 2.3 match string, returning names, titles, deprecation data, and superseding entries.
- `nvd_audit_cpe` finds CVEs for an exact CPE or a virtual match string with optional version bounds. It can apply a minimum severity filter to the fetched page.
- `nvd_get_cve_history` returns score changes, status transitions, reference additions, and CPE configuration updates in newest-first or oldest-first order.

## Limitations and notes

CVE search summaries contain truncated descriptions; use `nvd_get_cve` for complete records. CPE audits return full CVE records, so modest page sizes are preferable. Severity filtering in an audit applies only to the records retrieved for that page and cannot recover results outside the requested limit.

Exact CPE selection matters when auditing a product. Use `nvd_search_cpes` first when the required identifier is unknown. The CVE resource requires an identifier matching the `CVE-YYYY-NNNNN` format and reports an error for a well-formed but unknown ID. History queries are notably slower without an API key.

_Full upstream README: https://allmcps.com/mcp/nist-nvd-mcp-server/readme_