Cve MCP Server

If you already use Cve, the cve mcp server is the piece that lets your assistant work with it directly. A production-grade Model Context Protocol (MCP) server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs across NVD, EPSS, CISA KEV, Shodan, VirusTotal, and GreyNoise, ask Claude one question.

Available tools

The toolset is worth reading before you wire it up, because it tells you what the integration is really for:

• lookup_cve — Fetch detailed CVE record from NVD including CVSS scores, CWEs, affected products, references, and timeline
• search_cves — Search NVD for CVEs by keyword, product name, severity, or date range
• get_epss_score — Get EPSS exploitation probability (0–1) and percentile for one or more CVEs
• check_kev_status — Check whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog
• get_cvss_details — Parse and explain a CVSS v3.1 vector string with per-metric breakdown
• get_cwe_info — Look up Common Weakness Enumeration details by CWE ID from embedded database
• get_cve_references — Extract and categorize all reference links for a CVE (patches, advisories, exploits)
• bulk_cve_lookup — Batch-fetch details for up to 20 CVEs in a single call with parallel enrichment
• search_exploits — Search GitHub for public proof-of-concept exploits and exploit code repositories
• get_mitre_techniques — Map a CVE or CWE to relevant MITRE ATT&CK techniques, tactics, and mitigations
• check_poc_availability — Determine if known proof-of-concept code exists for a CVE across multiple sources
• get_attack_patterns — Retrieve CAPEC attack pattern details associated with a CWE or CVE

Installation

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

Credentials and setup notes

Configuration is passed through the environment: NVD_API_KEY, GITHUB_TOKEN, ABUSEIPDB_KEY, GREYNOISE_API_KEY, SHODAN_KEY, ABUSEIPDB_API_KEY, SHODAN_API_KEY, VIRUSTOTAL_API_KEY. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

• Python 3.10+ (3.11 or 3.12 recommended) - pip or uv package manager - Git for cloning the repository - A terminal with access to environment variables

Where it fits

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Cve's toolset — lookup_cve, search_cves, get_epss_score and 11 more — is a fair guide to whether it matches your workflow. It is maintained by mukul975; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Worth knowing first

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Cve.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.