Log inSubmit server
Nist Nvd MCP Server logo

Nist Nvd MCP Server

Search NIST NVD CVEs and CPEs, audit product versions, inspect CVSS data, and track vulnerability history over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Nist Nvd MCP Server

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "command": "bunx",
      "args": [
        "@cyanheads/nist-nvd-mcp-server@latest"
      ],
      "env": {
        "NVD_API_KEY": "YOUR_VALUE_HERE",
        "NVD_CLAMP_LIMITS": "YOUR_VALUE_HERE",
        "NVD_REQUEST_TIMEOUT_MS": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

bunx @cyanheads/nist-nvd-mcp-server@latest

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 9d ago.

Overview

nist-nvd-mcp-server connects MCP clients to the NIST National Vulnerability Database for CVE and CPE research. Its tools search vulnerabilities, retrieve detailed records, resolve products to CPE names, audit affected versions, and inspect CVE change history. It supports STDIO and Streamable HTTP, including a public hosted endpoint, and is suited to security triage, product exposure checks, and vulnerability investigations.

Use cases

  • Search CVEs by severity, CWE, keyword, or KEV status
  • Resolve product versions to exact NVD CPE names
  • Audit a product version for affected CVEs
  • Retrieve complete CVSS, CPE, CWE, and reference data
  • Review CVE score and status changes over time

Key features

  • NIST NVD CVE and CPE search
  • CPE-based product vulnerability auditing
  • CVSS, CWE, KEV, configuration, and reference lookup
  • CVE revision history retrieval
  • STDIO and Streamable HTTP transports
  • Request pacing for NVD rate limits

Tools5

What Nist Nvd MCP Server lets your agent do. Expand a tool for its parameters.

Self-reported~125 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

10/10 checks healthy over the last 58d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned just now via OSV.dev · @cyanheads/nist-nvd-mcp-server@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads1.7kPackage downloads in the last 30 days.
Last commit14d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed5Callable tools this server registers over MCP.

How Nist Nvd MCP Server works

What nist-nvd-mcp-server does

nist-nvd-mcp-server exposes NIST National Vulnerability Database data through MCP tools and resources. It covers both vulnerability records and the NVD CPE dictionary, allowing an agent to move from a product name to an exact CPE and then identify affected CVEs.

CVE searches can use keywords, severity bands, CWE identifiers, publication or modification dates, and CISA Known Exploited Vulnerabilities status. Individual lookups return CVSS data across supported versions, weaknesses, affected configurations, KEV fields, references, and optional SSVC assessments when NVD supplies them.

The server also publishes an nvd://cve/{cveId} JSON resource for a single CVE and a guide resource covering product applicability, identifier chains, severity interpretation, and coverage considerations.

How it works

The server queries NVD through either STDIO or Streamable HTTP transport. Requests are paced according to NVD limits: keyless access is limited to five requests per 30 seconds, while access with an API key is limited to 50 requests per 30 seconds. Retries enter the same queue, and a rate-limit response can pause queued work until the NVD window resets.

Search and audit results support pagination. Oversized requests are clamped by default, with the requested and effective limits reported in the response. Batch CVE lookup validates identifiers, removes duplicates, and reports IDs that were not processed or returned.

Setup and configuration

The package can be launched with npx -y @cyanheads/nist-nvd-mcp-server from an MCP client configuration. It can also be reached through the published Streamable HTTP endpoint at https://nist-nvd.caseyjhand.com/mcp.

Set NVD_API_KEY to use the higher NVD request budget and improve the performance of CVE history requests. NVD_REQUEST_TIMEOUT_MS controls the request timeout, which can be raised for slower history calls. Set NVD_CLAMP_LIMITS=false to disable the default oversized-request clamping and restore the advertised maximums; invalid zero, negative, and fractional limits remain rejected.

Tools and capabilities

  • nvd_search_cves searches by keyword, severity, CWE, date range, KEV status, and rejection status. Keyword matching uses AND semantics unless exact-phrase mode is selected.
  • nvd_get_cve retrieves one or up to 100 CVEs, with full or brief output and optional references, configurations, and localized descriptions.
  • nvd_search_cpes finds CPE entries by product keyword or partial CPE 2.3 match string, returning names, titles, deprecation data, and superseding entries.
  • nvd_audit_cpe finds CVEs for an exact CPE or a virtual match string with optional version bounds. It can apply a minimum severity filter to the fetched page.
  • nvd_get_cve_history returns score changes, status transitions, reference additions, and CPE configuration updates in newest-first or oldest-first order.

Limitations and notes

CVE search summaries contain truncated descriptions; use nvd_get_cve for complete records. CPE audits return full CVE records, so modest page sizes are preferable. Severity filtering in an audit applies only to the records retrieved for that page and cannot recover results outside the requested limit.

Exact CPE selection matters when auditing a product. Use nvd_search_cpes first when the required identifier is unknown. The CVE resource requires an identifier matching the CVE-YYYY-NNNNN format and reports an error for a well-formed but unknown ID. History queries are notably slower without an API key.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Nist Nvd MCP Server

nist-nvd-mcp-server is an MCP server that connects AI clients to the NIST National Vulnerability Database. Its main tools search CVEs, retrieve detailed CVE records, search CPEs, audit product versions, and retrieve CVE change history, including CVSS, CWE, KEV, configuration, and reference data.

Install it with `npx -y @cyanheads/nist-nvd-mcp-server` in an MCP client configuration. The project also publishes a Streamable HTTP endpoint at `https://nist-nvd.caseyjhand.com/mcp`, which clients can connect to instead of launching a local process.

Yes, nist-nvd-mcp-server has a Cursor installation link. Cursor can launch the package through `npx` using the server configuration supplied by the project.

Use `nvd_search_cpes` to find the exact CPE, then pass that identifier to `nvd_audit_cpe`. The audit tool can also accept a virtual match string with optional inclusive or exclusive version bounds and returns matching CVE records.

Set `NVD_API_KEY` before starting the server. Keyed access uses NVD's 50-requests-per-30-seconds budget instead of the five-request keyless budget, and it can improve the response time of CVE history requests.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewNist Nvd MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/nist-nvd-mcp-server?style=directory)](https://allmcps.com/mcp/nist-nvd-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/nist-nvd-mcp-server"><img src="https://allmcps.com/api/badge/nist-nvd-mcp-server?style=directory" alt="Nist Nvd MCP Server on AllMCPs" /></a>