{
  "markdown": "# NVD — National Vulnerability Database\n\nNIST's National Vulnerability Database. Every CVE (Common Vulnerabilities and Exposures) ever published — software vulnerabilities, severity scores (CVSS), affected products (CPEs), references. The authoritative source for \"is this software version vulnerable?\" Free, no auth (light rate limit; key recommended).\n\nPart of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 1476+ live data sources.\n\n## Why this matters for AI agents\n\nFor security analysis, supply-chain risk assessment, or \"what CVEs affect dependency X?\" the NVD is the source. Where commercial vulnerability databases add curation, the NVD is the raw federal record. Pair with [USPTO patents](/docs/reference/patents) for security IP, [SEC EDGAR](/docs/reference/edgar) for breach disclosures.\n\nCommon flows:\n\n- **CVE lookup.** Find specific CVE by ID for full record.\n- **Search by product / version.** \"What CVEs affect Apache Log4j 2.x?\" → keyword + CPE filter.\n- **Recent CVEs by severity.** Critical and high-severity disclosures published recently.\n- **CVSS scoring.** Each CVE has CVSS v2, v3.0, and v3.1 scores; agents should use v3.x for current analysis.\n\n## Auth\n\nNVD's REST API is free; an unauthenticated client gets ~5 requests per 30s. Get a free API key at https://nvd.nist.gov/developers/request-an-api-key for ~50 requests per 30s. Pass via `_apiKey`.\n\n## Severity classes (CVSS v3)\n\n| Score | Class |\n|---|---|\n| 0.1–3.9 | Low |\n| 4.0–6.9 | Medium |\n| 7.0–8.9 | High |\n| 9.0–10.0 | Critical |\n\nFor agent triage, \"High and Critical, last 90 days\" is the common attention slice.\n\n## Common pitfalls\n\n- **CPE matching is fiddly.** CPE (Common Platform Enumeration) is the controlled vocabulary for \"this CVE affects this product version.\" Software names in CPE often differ from how marketing names them. Use NVD's CPE search to find the right CPE before searching CVEs.\n- **CVE coverage isn't complete.** Some bugs are quietly patched without CVE assignment. Conversely, not every CVE is exploitable in practice. Triage by environment.\n- **Severity scoring is not exploitability.** A Critical CVSS score on a feature you don't use is irrelevant; a Medium CVSS on something exposed to the internet is worse than the score implies. Pair with EPSS (Exploit Prediction Scoring System) when available.\n- **Reserved vs published.** Reserved CVEs (\"RESERVED\") are placeholders awaiting public disclosure. The actual content lives in `description` once published. Filter `vulnStatus` for what's actually known.\n- **References lag.** Patches and exploit-detection signatures often appear before the NVD record updates. For real-time vulnerability response, layer GitHub Security Advisories or vendor channels on top.\n- **Modified vs published date.** The \"modified\" date often reflects re-scoring or reference updates, not new findings. For \"what was disclosed this week,\" sort by `publishedDate`.\n\n## Quick Start\n\nAdd to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):\n\n```json\n{\n  \"mcpServers\": {\n    \"nvd\": {\n      \"url\": \"https://gateway.pipeworx.io/nvd/mcp\"\n    }\n  }\n}\n```\n\n### What this endpoint actually serves\n\n`tools/list` at `https://gateway.pipeworx.io/nvd/mcp` returns the tools in the table\nabove **plus the shared Pipeworx meta-tools** — `ask_pipeworx`,\n`discover_tools`, `search_within`, `remember`/`recall` and the rest of the\ngateway-wide set. So the tool count you see is larger than this table: a\nsingle-pack endpoint currently lists roughly 30 shared tools alongside the\npack's own. The connection's `initialize` response states its exact scope, and\nis the authoritative answer for a given day.\n\nThis is deliberate, not multiplexing by accident. The meta-tools are what let a\nscoped connection answer a question this pack does not cover — via\n`ask_pipeworx`, which routes across the whole catalog — without you adding a\nsecond MCP server. There is currently no way to mount a pack endpoint without\nthem; if the extra schemas cost you more context than the routing is worth,\nconnect to the full gateway once rather than to several pack endpoints.\n\nOr connect to the full Pipeworx gateway to get every pack's tools listed\ndirectly, instead of just this one's:\n\n```json\n{\n  \"mcpServers\": {\n    \"pipeworx\": {\n      \"url\": \"https://gateway.pipeworx.io/mcp\"\n    }\n  }\n}\n```\n\nBoth URLs reach the same gateway and the same 1476+ data sources. The\nonly difference is which pack's tools are listed **directly**; `ask_pipeworx`\nreaches all of them from either one.\n\n## Using with ask_pipeworx\n\nInstead of calling tools directly, you can ask questions in plain English —\nthis works on the pack endpoint above as well as on the full gateway:\n\n```\nask_pipeworx({ question: \"your question about Nvd data\" })\n```\n\nThe gateway picks the right tool and fills the arguments automatically.\n\n## More\n\n- [Docs and guides](https://pipeworx.io/docs)\n- [pipeworx.io](https://pipeworx.io)\n\n## License\n\nMIT\n",
  "bytes": 4951,
  "sha": "d46582adbe7ec3bb01aa52783652fa4914214dfab065584c4940cc806bf0b9bc",
  "repo_slug": "pipeworx-io/mcp-nvd",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_pipeworx_io_nvd_f307be9e/readme"
}