Skip to content

io.github.cyanheads/nist-nvd-mcp-server

by cyanheads · remote · local (npm) · no sign-in to list tools · v0.3.2 · published by GitHub user cyanheads

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

Read only
CompareRegistry entry

5 tools: 5 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http nist-nvd https://nist-nvd.caseyjhand.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

5 tools

Only reads 5Claude Code: allow
  • nvd_audit_cpeFind all CVEs affecting a specific product and version using CPE (Common Platform Enumeration).No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. Use nvd_search_cpes first to resolve the correct CPE string for a product. Returns full CVE records.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: false
  • nvd_get_cveFetch one or more CVEs by ID from the NIST National Vulnerability Database.No findings

    Why it is in this group

    • The name "nvd_get_cve" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, and references. Up to 100 CVE IDs per call. For bulk lookups of more than 10 IDs, use brief: true — full records for 100 CVEs can exceed 1MB and exhaust context budgets.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: false
  • nvd_get_cve_historyRetrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates.No findings

    Why it is in this group

    • The name "nvd_get_cve_history" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. Events are returned newest-first by default; pass order="oldest" for the CVE's earliest events. For the current record, call nvd_get_cve instead. The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD_API_KEY for reliable operation.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: false
  • nvd_search_cpesSearch the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string.No findings

    Why it is in this group

    • The name "nvd_search_cpes" says "search": a word for reading.
    Description, as the server wrote it
    Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http_server:2.4.51:*:*:*:*:*:*:*) and must match exactly to audit the right product.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • nvd_search_cvesSearch CVEs by keyword, severity, CWE, date range, or CISA KEV status.No findings

    Why it is in this group

    • The name "nvd_search_cves" says "search": a word for reading.
    Description, as the server wrote it
    Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.3.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http nist-nvd https://nist-nvd.caseyjhand.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__nist-nvd__nvd_get_cve",
      "mcp__nist-nvd__nvd_search_cves",
      "mcp__nist-nvd__nvd_audit_cpe",
      "mcp__nist-nvd__nvd_search_cpes",
      "mcp__nist-nvd__nvd_get_cve_history"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as nist-nvd. Review it before you use it.