Nvd Cve MCP Server

What nvd-cve-mcp-server does

nvd-cve-mcp-server provides an MCP interface to vulnerability data published by the National Vulnerability Database. It supports two primary workflows: looking up one CVE by its identifier and finding CVEs through a keyword query. Results are formatted as Markdown for display in an MCP client.

A detail lookup can include the CVE identifier, description, CVSS score, severity, publication and modification timestamps, CWE classification, external references, and links to the NVD and CVE records. Search results are presented in a table with the CVE ID, severity, CVSS score, publication date, and a description.

The server supports English and Chinese usage. It is intended for security research and educational purposes, with use subject to applicable laws and ethical requirements.

How it works

Requests are sent to the NVD REST API at https://services.nvd.nist.gov/rest/json/cves/2.0 as the primary data path. If the API cannot be used, the server switches to NVD web pages and extracts key fields from the returned HTML using Cheerio. The response data identifies whether it came from the API or web source.

The get_cve_details tool accepts a required cve_id value. Identifiers must follow the CVE-YYYY-NNNNN pattern. The search_cves tool accepts a required keyword and an optional result limit. Search returns 10 results by default and permits up to 20.

Setup and configuration

Node.js 18 or newer and npm or yarn are required. The simplest setup runs the package through npx, without a separate installation:

{
  "mcpServers": {
    "nvd-cve": {
      "command": "npx",
      "args": ["-y", "nvd-cve-mcp-server"]
    }
  }
}

Add this server entry to the configuration for Claude Desktop or another MCP-compatible application. The same command can be used on macOS, Linux, and Windows, with the client configuration stored in that platform's normal location. Alternatively, install the package globally with npm install -g nvd-cve-mcp-server, install it locally with npm install nvd-cve-mcp-server, or run the project with npm start.

The process requires network access to nvd.nist.gov. No API key or environment variable is specified for the standard setup.

Tools and capabilities

• get_cve_details: retrieves information for a single CVE ID.
• search_cves: searches CVE records by keyword, with configurable result count.
• API-first retrieval through the NVD vulnerability endpoint.
• Web-scraping fallback for NVD pages when the API is unavailable.
• Markdown output for detailed records and search tables.
• English and Chinese language support.

Limitations and notes

NVD API rate limits apply, so repeated or high-volume requests should be made responsibly. Results depend on network access and the availability of the NVD API or website. A missing CVE may indicate an invalid identifier, a CVE that has not been published to NVD, or a query that did not match the available data. Broader search terms can help when a keyword query returns no results. CVE records are updated regularly, so retrieved information should be checked when freshness matters.