Cve Cache

What cve-cache MCP server does

The cve-cache MCP server gives AI agents access to cached vulnerability records from CVE and GitHub Security Advisory data. It is intended for dependency audits, package screening, and quick review of recent high-severity findings. Records are normalized across npm, PyPI, Cargo, Maven, and Go, so an agent can use the same tool pattern across supported ecosystems.

The data is a snapshot rather than a live advisory search. That makes the server suitable when an agent needs fast lookups against recently collected records and does not need to construct separate requests to multiple vulnerability services.

How it works

The package runs as a stdio MCP server. An MCP-compatible client starts the process and communicates with it through the configuration for the server. The agent sends a tool call, and the server returns structured data from its cached CVE and GHSA records.

This approach avoids passing large source records through an agent workflow and keeps cross-ecosystem results in a common format. The project describes the cache as covering recent records, with the recent-critical query using a seven-day default window and a CVSS threshold of 7 or higher.

Setup and configuration

Install the package globally with npm:

npm install -g @weiseer/cve-cache-mcp

A client can also start it with npx, using the package name as the command argument:

{
  "mcpServers": {
    "cve-cache": {
      "command": "npx",
      "args": ["-y", "@weiseer/cve-cache-mcp"]
    }
  }
}

The documented setup is client configuration over stdio.

Tools and capabilities

The cve-cache MCP server exposes four documented operations:

• lookup_cve retrieves the complete cached record for one CVE or GHSA identifier.
• find_for_package returns vulnerabilities associated with a package, filtered by ecosystem.
• list_recent_critical lists recent high-severity vulnerabilities. Its documented defaults are a seven-day period and CVSS of at least 7.
• severity_summary reports counts grouped into severity categories.

Together, these operations cover both focused investigation and broader screening. An agent can inspect a known advisory, check a dependency by package ecosystem, identify recent critical findings, or summarize the severity distribution in the available cache.

Limitations and notes

Results depend on the contents and freshness of the cached snapshot. The material does not specify an update schedule, retention period, package-version matching behavior, or whether every CVE and GHSA record is included. It also does not document a live fallback to NVD or GitHub Advisory queries.

The catalog is derived from public CVE, NVD, and GHSA feeds, with the catalog data identified as CC0/public domain. The software is licensed under Apache-2.0. Use the server when cached, normalized records fit the audit task; verify findings against authoritative advisory sources when current or complete coverage is required.