# nvd [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-nvd  
**GitHub Stars:** 0  
**npm Downloads (last month):** 725  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nvd

## Description
NVD MCP — wraps the NIST National Vulnerability Database API (free, no auth)

## Tools
Capabilities this server exposes over MCP:

- **search_cves** — Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.
- **get_cve** — Get full details for a specific CVE (e.g., "CVE-2021-44228"). Returns description, severity, CVSS score, affected products, and remediation info. Use when you need comprehensive vulnerability analysis.
- **recent_cves** — Get CVEs published within a date range (use ISO 8601 format, e.g., "2024-01-01T00:00:00.000Z"). Returns CVE IDs, descriptions, and severity. Use to track newly disclosed vulnerabilities.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "nvd": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-nvd"]
  }
}
```

## Documentation

## What nvd does

nvd provides MCP access to NIST's National Vulnerability Database through Pipeworx. The underlying records cover published CVEs, affected products represented with Common Platform Enumeration (CPE), references, and CVSS v2, v3.0, and v3.1 scores.

Typical queries include retrieving a CVE by identifier, finding vulnerabilities associated with a product or version, and reviewing recently published high- or critical-severity disclosures. The service is useful for security analysis and supply-chain review when an agent needs the federal vulnerability record rather than a separately curated commercial database.

NVD data should be treated as one input to triage. A CVSS score describes severity, not the likelihood that a vulnerability is exploitable in a particular environment. CVE coverage is also incomplete, and references or patch information can lag behind other sources.

## How it works

The hosted MCP endpoint is `https://gateway.pipeworx.io/nvd/mcp`. A client connects to that URL and receives the NVD pack's tools along with shared Pipeworx meta-tools. The shared `ask_pipeworx` tool can route a natural-language question across the wider Pipeworx catalog, including from a scoped pack connection.

The same gateway also exposes the full catalog at `https://gateway.pipeworx.io/mcp`. The pack URL lists NVD tools directly, while the full URL lists the broader catalog directly; both can reach the gateway's data sources.

Clients without MCP support can call the gateway over HTTP. For example, `POST https://gateway.pipeworx.io/v1/tools/search_cves` accepts a JSON request such as `{ "query": "log4j" }`. Tool details can be retrieved with `GET /v1/tools/search_cves`.

## Setup and configuration

For a hosted connection, add the NVD endpoint to an MCP client configuration:

```json
{
  "mcpServers": {
    "nvd": {
      "url": "https://gateway.pipeworx.io/nvd/mcp"
    }
  }
}
```

The npm package `@pipeworx/mcp-nvd` provides a local stdio bridge. Start it with `npx -y @pipeworx/mcp-nvd`; it forwards requests to the hosted gateway and therefore requires network access. It does not provide offline operation.

Anonymous npm usage is available with a daily call limit. Setting `PIPEWORX_API_KEY` adds a Pipeworx bearer token and raises the documented daily allowance. Set `PIPEWORX_META_TOOLS=1` if the local bridge should also list shared gateway tools such as `ask_pipeworx`.

## Tools and capabilities

- Search CVE records with `search_cves`.
- Look up vulnerabilities by product, version, keyword, or CPE-related criteria.
- Review CVSS severity information across versions 2, 3.0, and 3.1.
- Inspect references and affected product records.
- Route broader questions through the shared `ask_pipeworx` tool.
- Discover or search gateway tools when shared meta-tools are enabled.

## Limitations and notes

Unauthenticated NVD API access is rate-limited to approximately five requests per 30 seconds. An NVD API key raises that allowance to approximately 50 requests per 30 seconds; the key is passed to the upstream API as `_apiKey` when applicable.

CPE names can differ from product marketing names, so identifying the correct CPE may require a separate search before querying CVEs. Use `publishedDate` for newly disclosed vulnerabilities; `modified` can change because of rescoring or reference updates. Filter out reserved records when you need published vulnerability details. For operational response, supplement NVD results with vendor advisories, GitHub Security Advisories, or exploit-probability data such as EPSS.

_Full upstream README: https://allmcps.com/mcp/nvd/readme_