Nvd

What nvd does

nvd provides MCP access to NIST's National Vulnerability Database through Pipeworx. The underlying records cover published CVEs, affected products represented with Common Platform Enumeration (CPE), references, and CVSS v2, v3.0, and v3.1 scores.

Typical queries include retrieving a CVE by identifier, finding vulnerabilities associated with a product or version, and reviewing recently published high- or critical-severity disclosures. The service is useful for security analysis and supply-chain review when an agent needs the federal vulnerability record rather than a separately curated commercial database.

NVD data should be treated as one input to triage. A CVSS score describes severity, not the likelihood that a vulnerability is exploitable in a particular environment. CVE coverage is also incomplete, and references or patch information can lag behind other sources.

How it works

The hosted MCP endpoint is https://gateway.pipeworx.io/nvd/mcp. A client connects to that URL and receives the NVD pack's tools along with shared Pipeworx meta-tools. The shared ask_pipeworx tool can route a natural-language question across the wider Pipeworx catalog, including from a scoped pack connection.

The same gateway also exposes the full catalog at https://gateway.pipeworx.io/mcp. The pack URL lists NVD tools directly, while the full URL lists the broader catalog directly; both can reach the gateway's data sources.

Clients without MCP support can call the gateway over HTTP. For example, POST https://gateway.pipeworx.io/v1/tools/search_cves accepts a JSON request such as { "query": "log4j" }. Tool details can be retrieved with GET /v1/tools/search_cves.

Setup and configuration

For a hosted connection, add the NVD endpoint to an MCP client configuration:

{
  "mcpServers": {
    "nvd": {
      "url": "https://gateway.pipeworx.io/nvd/mcp"
    }
  }
}

The npm package @pipeworx/mcp-nvd provides a local stdio bridge. Start it with npx -y @pipeworx/mcp-nvd; it forwards requests to the hosted gateway and therefore requires network access. It does not provide offline operation.

Anonymous npm usage is available with a daily call limit. Setting PIPEWORX_API_KEY adds a Pipeworx bearer token and raises the documented daily allowance. Set PIPEWORX_META_TOOLS=1 if the local bridge should also list shared gateway tools such as ask_pipeworx.

Tools and capabilities

• Search CVE records with search_cves.
• Look up vulnerabilities by product, version, keyword, or CPE-related criteria.
• Review CVSS severity information across versions 2, 3.0, and 3.1.
• Inspect references and affected product records.
• Route broader questions through the shared ask_pipeworx tool.
• Discover or search gateway tools when shared meta-tools are enabled.

Limitations and notes

Unauthenticated NVD API access is rate-limited to approximately five requests per 30 seconds. An NVD API key raises that allowance to approximately 50 requests per 30 seconds; the key is passed to the upstream API as _apiKey when applicable.

CPE names can differ from product marketing names, so identifying the correct CPE may require a separate search before querying CVEs. Use publishedDate for newly disclosed vulnerabilities; modified can change because of rescoring or reference updates. Filter out reserved records when you need published vulnerability details. For operational response, supplement NVD results with vendor advisories, GitHub Security Advisories, or exploit-probability data such as EPSS.