Nist Nvd Mcp Server
by cyanheadscommunityv0.2.0
1
1
An MCP server for querying the NIST National Vulnerability Database (NVD) to search CVEs, fetch CVE details and history, search CPEs, and audit whether a product version is affected by vulnerabilities. It exposes these capabilities over STDIO or Streamable HTTP and also provides a stable CVE resource URI.
From the registry: Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
Install & configure
Prerequisites
- requiredInstall Node.jsRequired for the preferred npx-based install path. README states Node.js v24+ is supported.https://nodejs.org/
- optionalOptional: Create an NVD API keyImproves NVD API rate limits from 5 requests per 30 seconds to 50 requests per 30 seconds. Strongly recommended, especially for slower endpoints like CVE history.https://nvd.nist.gov/developers/request-an-api-key
Install in your client
Paste into the AI you're chatting with — it will figure out the rest
Please install the `nist-nvd-mcp-server` MCP server into my current AI client (that's you).
Required prerequisites (do these first if not already done):
- **Install Node.js** — Required for the preferred npx-based install path. README states Node.js v24+ is supported. (https://nodejs.org/)
Optional prerequisites:
- Optional: Create an NVD API key — Improves NVD API rate limits from 5 requests per 30 seconds to 50 requests per 30 seconds. Strongly recommended, especially for slower endpoints like CVE history. (https://nvd.nist.gov/developers/request-an-api-key)
Canonical MCP server config (stdio transport):
- command: `npx`
- args: ["-y","nist-nvd-mcp-server@latest"]
- required environment variables:
- `MCP_TRANSPORT_TYPE`: Transport type for the server. For stdio configuration, set to stdio. (example: `stdio`)
- optional environment variables:
- `NVD_API_KEY`: NVD API key for higher rate limits and better reliability, especially for history queries. (example: `<your-api-key>`)
- `MCP_LOG_LEVEL`: Log level in RFC 5424 format. (example: `info`)
- `NVD_REQUEST_TIMEOUT_MS`: Per-request timeout in milliseconds. Increase if using slow endpoints such as CVE history without an API key. (example: `<timeout-in-ms>`)
- `MCP_AUTH_MODE`: Authentication mode: none, jwt, or oauth. (example: `none`)
- `MCP_HTTP_PORT`: HTTP port used only when transport is http. (example: `<port>`)
- `LOGS_DIR`: Directory for log files (Node.js only). (example: `<path-to-logs-directory>`)
- `OTEL_ENABLED`: Enable OpenTelemetry instrumentation. (example: `false`)
Note: The README also documents Streamable HTTP mode, but the simplest portable client config is stdio via npx. HTTP mode is started separately by setting MCP_TRANSPORT_TYPE=http and MCP_HTTP_PORT, and the server listens at /mcp.
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.Note: The README also documents Streamable HTTP mode, but the simplest portable client config is stdio via npx. HTTP mode is started separately by setting MCP_TRANSPORT_TYPE=http and MCP_HTTP_PORT, and the server listens at /mcp.
Tools (5)
nvd_search_cves
Search CVEs by keyword, severity, CWE, date range, or CISA KEV status.
nvd_get_cve
Fetch one or more CVEs by ID with full details or brief summaries.
nvd_search_cpes
Search the NVD CPE dictionary by product keyword or partial match string.
nvd_audit_cpe
Find all CVEs affecting a specific product version by CPE name or virtual match string.
nvd_get_cve_history
Retrieve the change history for a CVE, including score revisions, status transitions, and reference additions.
Environment variables
NVD_API_KEYrequiredNVD API key used to increase rate limits and improve reliability, especially for history requests.Prerequisites
- • Node.js v24+
Packages
@cyanheads/nist-nvd-mcp-server
npmv0.2.0transport: stdio
@cyanheads/nist-nvd-mcp-server
npmv0.2.0transport: streamable-http
Details
- Language
- TypeScript
- License
- Apache-2.0
- Released
- Jul 31, 2026
- Last commit
- Jun 20, 2026
- Registry name
- io.github.cyanheads/nist-nvd-mcp-server