Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "type": "http",
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}

claude mcp add --transport http nist-nvd-mcp-server https://nist-nvd.caseyjhand.com/mcp

[mcp_servers.nist-nvd-mcp-server]
url = "https://nist-nvd.caseyjhand.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nist-nvd-mcp-server": {
      "type": "remote",
      "url": "https://nist-nvd.caseyjhand.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "type": "http",
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=nist-nvd-mcp-server&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbmlzdC1udmQuY2FzZXlqaGFuZC5jb20vbWNwIn0%3D"
}

{
  "servers": {
    "nist-nvd-mcp-server": {
      "type": "http",
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "httpUrl": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}

extensions:
  "nist-nvd-mcp-server":
    enabled: true
    name: "nist-nvd-mcp-server"
    type: streamable_http
    uri: "https://nist-nvd.caseyjhand.com/mcp"
    timeout: 300

Quality 89 / 100good

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations5 of 5 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: nvd_search_cves (destructiveHint, idempotentHint); nvd_audit_cpe (destructiveHint); nvd_search_cpes (destructiveHint, idempotentHint); …
pass
tools.token_costabout 2,577 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvabledeps.dev does not know @cyanheads/[email protected], @cyanheads/[email protected]

5 tools, about 2,577 tokens to load them all · tool set b7df554f359c · checked 2026-10-20 20:14 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance80

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +reachable +uptime-100% +updated-12d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@cyanheads/[email protected] npmthis version is not known to the dependency resolver

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://nist-nvd.caseyjhand.com/mcp` streamable-http	none	yes	100%	184 ms	2026-07-28	2026-10-20

package	registry	version	runtime	secrets
`@cyanheads/nist-nvd-mcp-server`	npm	0.3.2	npx
`@cyanheads/nist-nvd-mcp-server`	npm	0.3.2	npx

Tools (5)

`nvd_audit_cpe`read-only	Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. Use nvd_search_cpes first to resolve the correct CPE string for a product. Returns full CVE records.
`nvd_get_cve`read-only	Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, and references. Up to 100 CVE IDs per call. For bulk lookups of more than 10 IDs, use brief: true — full records for 100 CVEs can exceed 1MB and exhaust context budgets.
`nvd_get_cve_history`read-only	Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. Events are returned newest-first by default; pass order="oldest" for the CVE's earliest events. For the current record, call nvd_get_cve instead. The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD_API_KEY for reliable operation.
`nvd_search_cpes`read-only	Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http_server:2.4.51:::::::*) and must match exactly to audit the right product.
`nvd_search_cves`read-only	Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).

Schemas: list_tools.

Similar MCP servers

More from io.github.cyanheads

And 140 more from this publisher.

Official server.json

{
  "name": "io.github.cyanheads/nist-nvd-mcp-server",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://nist-nvd.caseyjhand.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.3.2",
  "packages": [
    {
      "version": "0.3.2",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@cyanheads/nist-nvd-mcp-server",
      "runtimeHint": "npx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "NVD_API_KEY",
          "format": "string",
          "description": "NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key."
        },
        {
          "name": "NVD_REQUEST_TIMEOUT_MS",
          "format": "string",
          "default": "10000",
          "description": "Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key."
        },
        {
          "name": "MCP_LOG_LEVEL",
          "format": "string",
          "default": "info",
          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
        }
      ]
    },
    {
      "version": "0.3.2",
      "transport": {
        "url": "http://localhost:3010/mcp",
        "type": "streamable-http"
      },
      "identifier": "@cyanheads/nist-nvd-mcp-server",
      "runtimeHint": "npx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "MCP_TRANSPORT_TYPE",
          "value": "http",
          "format": "string",
          "description": "Selects the HTTP transport."
        },
        {
          "name": "NVD_API_KEY",
          "format": "string",
          "description": "NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key."
        },
        {
          "name": "NVD_REQUEST_TIMEOUT_MS",
          "format": "string",
          "default": "10000",
          "description": "Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key."
        },
        {
          "name": "MCP_HTTP_HOST",
          "format": "string",
          "default": "127.0.0.1",
          "description": "The hostname for the HTTP server."
        },
        {
          "name": "MCP_HTTP_PORT",
          "format": "string",
          "default": "3010",
          "description": "The port to run the HTTP server on."
        },
        {
          "name": "MCP_HTTP_ENDPOINT_PATH",
          "format": "string",
          "default": "/mcp",
          "description": "The endpoint path for the MCP server."
        },
        {
          "name": "MCP_AUTH_MODE",
          "format": "string",
          "default": "none",
          "description": "Authentication mode to use: 'none', 'jwt', or 'oauth'."
        },
        {
          "name": "MCP_LOG_LEVEL",
          "format": "string",
          "default": "info",
          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/cyanheads/nist-nvd-mcp-server",
    "source": "github"
  },
  "description": "Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE."
}