Vuln Nist MCP Server

What HaroldFinchIFT/vuln-nist-mcp-server MCP server does

HaroldFinchIFT/vuln-nist-mcp-server MCP server provides an MCP interface to the NIST National Vulnerability Database (NVD) vulnerability API. It returns formatted text intended for consumption by language models and supports several common vulnerability research workflows: finding CVEs by keyword, retrieving one CVE, examining vulnerabilities associated with a product CPE, checking CISA Known Exploited Vulnerabilities (KEV) additions, and reviewing CVE change history.

The server uses public NVD endpoints and does not require an API key. It needs network access to the NVD service. Its output includes dates and references where those are part of the corresponding NVD response.

How it works

The get_temporal_context tool supplies the current date and example date mappings for requests such as “this year,” “last year,” or “six months ago.” It should be called first for time-relative questions so a follow-up query can use explicit dates.

search_cves accepts a keyword and optional pagination and date parameters. Absolute start_date and end_date values take precedence over last_days; if neither is supplied, the search defaults to the most recent 30 days. The older recent_days parameter is deprecated. Results are ordered newest first.

Date ranges longer than 120 days for applicable NVD queries, or longer than 90 days for KEV queries, are divided into smaller requests and processed in parallel. The combined results are sorted chronologically. This can reduce the work required for broad searches, but large queries may still take longer than focused lookups.

Setup and configuration

Docker is the recommended runtime. The documented flow is to clone the repository, build an image named vuln-nist-mcp-server, and run it interactively with Docker. Python 3.11 or newer is also listed as a prerequisite for non-Docker use, although the supplied quick start does not provide a separate Python launch command.

The HaroldFinchIFT/vuln-nist-mcp-server MCP server reads these optional environment variables:

• NVD_BASE_URL changes the API base URL; it defaults to https://services.nvd.nist.gov/rest/json.
• NVD_VERSION selects the API version path and defaults to /2.0.
• NVD_API_TIMEOUT sets the request timeout in seconds and defaults to 10.

A client must be MCP-compatible, such as Claude Desktop. The host also needs network access to services.nvd.nist.gov.

Tools and capabilities

• get_cve_by_id retrieves details, references, tags, and publication dates for a supplied CVE identifier.
• cves_by_cpe searches by a full CPE 2.3 name and can filter by whether the configuration is vulnerable. The server validates the CPE format.
• kevs_between finds CVEs added to the CISA KEV catalog between two dates, with pagination support.
• cve_change_history accepts either a CVE identifier or a change-date range and returns the matching history.
• search_cves supports result limits, offsets, relative day windows, and ISO-style absolute date ranges.

Input sanitization, date parsing, timeout handling, malformed-response handling, and API error handling are included. Diagnostic logging is written to stderr. The Docker configuration runs as a non-root user, and the project states that it does not persist sensitive data.

Limitations and notes

Queries depend on availability of the public NVD endpoints and require outbound network access. The CPE search requires the complete CPE 2.3 format rather than a partial product name. Broad date queries are automatically split, but the number of requests can increase with the requested range. For relative time expressions, call the temporal-context tool before constructing the main query.