\n\n[](https://github.com/cyanheads/nist-nvd-mcp-server/releases/latest/download/nist-nvd-mcp-server.mcpb) [](https://cursor.com/en/install-mcp?name=nist-nvd-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvbmlzdC1udmQtbWNwLXNlcnZlciJdfQ==) [](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22nist-nvd-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fnist-nvd-mcp-server%22%5D%7D)\n\n[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)\n\n
\n\n---\n\n## Tools\n\nFive tools for vulnerability research, CPE auditing, and change tracking against the NIST NVD API 2.0:\n\n| Tool | Description |\n|:-----|:------------|\n| `nvd_search_cves` | Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. |\n| `nvd_get_cve` | Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and references. |\n| `nvd_search_cpes` | Search the NVD CPE dictionary by product keyword or partial match string. |\n| `nvd_audit_cpe` | Find all CVEs affecting a specific product version by CPE name or virtual match string. |\n| `nvd_get_cve_history` | Retrieve the change history for a CVE — score revisions, status transitions, and reference additions. |\n\n### `nvd_search_cves`\n\nThe primary discovery tool for vulnerability surveillance and triage workflows.\n\n- Full-text keyword search across CVE descriptions (AND-semantics across words), or `exactPhrase: true` to match the keyword as a phrase\n- Severity filter by CVSS v2/v3/v4 label (LOW, MEDIUM, HIGH, CRITICAL)\n- CWE weakness filter (e.g., `CWE-79`, `NVD-CWE-Other`)\n- CISA KEV filter — limit results to known-exploited vulnerabilities\n- Convenience date shorthands: `pubDays` and `lastModDays` for \"last N days\" queries\n- Explicit ISO 8601 date range parameters (`pubStartDate`/`pubEndDate`, etc.) with 120-day max span\n- Auto-clamps convenience date params that exceed 120 days and reports clamped values in the response enrichment\n- Pagination via `limit` (up to 2000) and `offset`\n- Every row carries a truncated description alongside the ID, so results are distinguishable without a follow-up fetch\n- Results are always brief; call `nvd_get_cve` for full detail\n\n---\n\n### `nvd_get_cve`\n\nFetch one or more CVEs by ID with full detail or brief summaries.\n\n- Batch up to 100 CVE IDs per call\n- Full mode: all CVSS scores across v2.0, v3.0, v3.1, and v4.0; CWE weaknesses; CPE configurations; CISA KEV fields; references\n- Brief mode (`brief: true`): ID, status, top severity, KEV name, truncated description — recommended for batches larger than 10\n- `includeReferences: false` to strip the references array and reduce response size\n- Per-ID parity check: the `missingIds` enrichment field lists any requested IDs NVD didn't return\n- Rendered text carries the affected-product criteria and references the record holds, capped with a `… N more` trailer; `allLanguages: true` renders every localized description, not just English\n\n---\n\n### `nvd_search_cpes`\n\nLook up product identifiers before auditing.\n\n- Keyword search (e.g., `\"apache http server\"`, `\"openssl\"`) or partial CPEv2.3 pattern\n- Returns full CPE name, human-readable title, deprecation status, and superseding CPEs\n- Pagination via `limit` (up to 10,000 per page) and `offset` — a vendor-level keyword can match tens of thousands of entries, so page with `offset` rather than trying to narrow further\n- Use this before `nvd_audit_cpe` — CPE names are arcane strings; guessing audits the wrong product\n\n---\n\n### `nvd_audit_cpe`\n\nFull CVE audit for a specific product version.\n\n- Two modes: exact `cpeName` (NVD auto-applies `isVulnerable`) or `virtualMatchString` with optional version range bounds\n- Version range via `versionStart`/`versionEnd` with inclusive/exclusive type control\n- Client-side severity filter (`severityMin`) to strip low-signal entries\n- Returns full CVE records (ID, CVSS scores, CWE, CPE configurations, KEV fields, references)\n- Pagination via `limit` (up to 2000) and `offset` — page at a modest `limit` instead of raising it, since each result is a full record\n- Echoes the CPE identifier used in the response enrichment so callers can verify the correct product was queried\n\n---\n\n### `nvd_get_cve_history`\n\nTrack a CVE's lifecycle over time.\n\n- Returns change events: CVSS revisions, status transitions, reference additions, CPE configuration updates\n- `order` picks which end to read from — `newest` (default) returns the most recent events first, `oldest` returns NVD's native oldest-first order\n- Paginated via `limit` and `offset`, where `offset` counts from the end `order` anchors to\n- Note: the NVD history endpoint is significantly slower without an API key — set `NVD_API_KEY` and raise `NVD_REQUEST_TIMEOUT_MS` for reliable operation\n\n## Resource\n\n| Type | Name | Description |\n|:-----|:-----|:------------|\n| Resource | `nvd://cve/{cveId}` | Full CVE record by ID — same data as `nvd_get_cve` for a single ID, as a stable URI for injectable context. |\n\nAll resource data is also reachable via tools.\n\n## Features\n\nBuilt on [`@cyanheads/mcp-ts-core`](https://www.npmjs.com/package/@cyanheads/mcp-ts-core):\n\n- Declarative tool, resource, and prompt definitions — single file per primitive, framework handles registration and validation\n- Unified error handling — handlers throw, framework catches, classifies, and formats\n- Pluggable auth: `none`, `jwt`, `oauth`\n- Swappable storage backends: `in-memory`, `filesystem`, `Supabase`, `Cloudflare KV/R2/D1`\n- Structured logging with optional OpenTelemetry tracing\n- STDIO and Streamable HTTP transports\n\nNVD-specific:\n\n- Request pacer enforces NVD's 5 req/30s (no key) and 50 req/30s (with key) limits with automatic queuing, at a minimum inter-request gap derived from the window and limit\n- Retry wraps the pacer rather than sitting inside it — every attempt takes its own turn in the queue, so retries count against the rate budget instead of bursting past it\n- A 403's `Retry-After` holds the whole queue until NVD's window resets. Keyless, a 403 fails fast and names `NVD_API_KEY` rather than spending a 5-request budget on retries that cannot outlast a 30-second window\n- Deterministic rejections fail fast instead of consuming retries. NVD answers both a bad parameter and a refused API key with HTTP 404, separated only by a `message` header — a refused key surfaces as a config fault naming `NVD_API_KEY` rather than as a malformed CVE ID\n- HTML-response guard catches NVD rate-limit pages served as HTML instead of 403\n\nAgent-friendly output:\n\n- An `enrichment` block on every response, carried on both `structuredContent` and the rendered text — total results, returned count, page offset, the filters actually applied, and any date-clamping events, so agents can reason about what was really queried\n- `missingIds` in batch CVE lookups — per-ID parity check instead of a silent partial result\n- CPE echo in audit responses — `cpeName` or `virtualMatchString` reflected back so callers can verify the correct product was audited\n- Empty-result notices that name the cause — an unmatched query, a severity threshold that emptied the page, and an offset past the end of the result set are told apart rather than all reading as \"nothing found\"\n- An audit that finds nothing is a result, not an error — a product with no CVEs in NVD returns an empty page with `totalCount: 0` on either input arm, so \"no known vulnerabilities\" reads as the answer it is\n\n## Getting started\n\nAdd the following to your MCP client configuration file.\n\n```json\n{\n \"mcpServers\": {\n \"nist-nvd-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"bunx\",\n \"args\": [\"@cyanheads/nist-nvd-mcp-server@latest\"],\n \"env\": {\n \"MCP_TRANSPORT_TYPE\": \"stdio\",\n \"MCP_LOG_LEVEL\": \"info\",\n \"NVD_API_KEY\": \"your-api-key\"\n }\n }\n }\n}\n```\n\nOr with npx (no Bun required):\n\n```json\n{\n \"mcpServers\": {\n \"nist-nvd-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@cyanheads/nist-nvd-mcp-server@latest\"],\n \"env\": {\n \"MCP_TRANSPORT_TYPE\": \"stdio\",\n \"MCP_LOG_LEVEL\": \"info\",\n \"NVD_API_KEY\": \"your-api-key\"\n }\n }\n }\n}\n```\n\nOr with Docker:\n\n```json\n{\n \"mcpServers\": {\n \"nist-nvd-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"docker\",\n \"args\": [\n \"run\", \"-i\", \"--rm\",\n \"-e\", \"MCP_TRANSPORT_TYPE=stdio\",\n \"-e\", \"NVD_API_KEY=your-api-key\",\n \"ghcr.io/cyanheads/nist-nvd-mcp-server:latest\"\n ]\n }\n }\n}\n```\n\nFor Streamable HTTP, set the transport and start the server:\n\n```sh\nMCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 NVD_API_KEY=... bun run start:http\n# Server listens at http://localhost:3010/mcp\n```\n\n### Prerequisites\n\n- [Bun v1.3.0](https://bun.sh/) or higher (or Node.js v24+).\n- Optional: [NVD API key](https://nvd.nist.gov/developers/request-an-api-key) — free, raises rate limit from 5 req/30s to 50 req/30s.\n\n### Installation\n\n1. **Clone the repository:**\n\n```sh\ngit clone https://github.com/cyanheads/nist-nvd-mcp-server.git\n```\n\n2. **Navigate into the directory:**\n\n```sh\ncd nist-nvd-mcp-server\n```\n\n3. **Install dependencies:**\n\n```sh\nbun install\n```\n\n4. **Configure environment:**\n\n```sh\ncp .env.example .env\n# edit .env and set NVD_API_KEY if you have one\n```\n\n## Configuration\n\n| Variable | Description | Default |\n|:---------|:------------|:--------|\n| `NVD_API_KEY` | NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key). | — |\n| `NVD_REQUEST_TIMEOUT_MS` | Per-request timeout in milliseconds. The history endpoint is slow without an API key — raise to 60000 if using `nvd_get_cve_history` without a key. | `10000` |\n| `MCP_TRANSPORT_TYPE` | Transport: `stdio` or `http`. | `stdio` |\n| `MCP_HTTP_PORT` | Port for HTTP server. | `3010` |\n| `MCP_AUTH_MODE` | Auth mode: `none`, `jwt`, or `oauth`. | `none` |\n| `MCP_LOG_LEVEL` | Log level (RFC 5424). | `info` |\n| `LOGS_DIR` | Directory for log files (Node.js only). | `/logs` |\n| `OTEL_ENABLED` | Enable [OpenTelemetry instrumentation](https://github.com/cyanheads/mcp-ts-core/tree/main/docs/telemetry). | `false` |\n\nSee [`.env.example`](./.env.example) for the full list of optional overrides.\n\n## Running the server\n\n### Local development\n\n- **Build and run:**\n\n ```sh\n # One-time build\n bun run rebuild\n\n # Run the built server\n bun run start:stdio\n # or\n bun run start:http\n ```\n\n- **Run checks and tests:**\n\n ```sh\n bun run devcheck # Lint, format, typecheck, security\n bun run test # Vitest test suite\n bun run lint:mcp # Validate MCP definitions against spec\n ```\n\n### Docker\n\n```sh\ndocker build -t nist-nvd-mcp-server .\ndocker run --rm -e NVD_API_KEY=your-key -p 3010:3010 nist-nvd-mcp-server\n```\n\nThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to `/var/log/nist-nvd-mcp-server`. OpenTelemetry peer dependencies are installed by default — build with `--build-arg OTEL_ENABLED=false` to omit them.\n\n## Project structure\n\n| Directory | Purpose |\n|:----------|:--------|\n| `src/index.ts` | `createApp()` entry point — registers tools/resources and inits services. |\n| `src/config` | Server-specific environment variable parsing and validation with Zod. |\n| `src/mcp-server/tools` | Tool definitions (`*.tool.ts`). |\n| `src/mcp-server/resources` | Resource definitions (`*.resource.ts`). |\n| `src/services/nvd-http` | NVD HTTP client with rate-limit pacing and retry. |\n| `src/services/nvd-cve` | CVE service — search, fetch-by-ID, CPE audit, change history, normalization. |\n| `src/services/nvd-cpe` | CPE service — dictionary search and normalization. |\n| `src/services/nvd-source` | Source service — resolves NVD contributor identifiers to their published names. |\n| `tests/` | Unit and integration tests mirroring `src/`. |\n\n## Development guide\n\nSee [`CLAUDE.md`](./CLAUDE.md) for development guidelines and architectural rules. The short version:\n\n- Handlers throw, framework catches — no `try/catch` in tool logic\n- Use `ctx.log` for request-scoped logging, `ctx.state` for tenant-scoped storage\n- Register new tools and resources via the barrels in `src/mcp-server/*/definitions/index.ts`\n- Wrap external API calls: validate raw → normalize to domain type → return output schema; never fabricate missing fields\n\n## Contributing\n\nIssues and pull requests are welcome. Run checks and tests before submitting:\n\n```sh\nbun run devcheck\nbun run test\n```\n\n## License\n\nApache-2.0 — see [LICENSE](LICENSE) for details.\n",
"bytes": 14435,
"sha": "3721556f7afd314993f92165d3dc8462a76e198cffd2c61bf432841cb9c3cac3",
"repo_slug": "cyanheads/nist-nvd-mcp-server",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_cyanheads_nist_nvd_mcp_server_db7ae0d5/readme"
}