How do I install the nist mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `MCP_TRANSPORT_TYPE`, `MCP_LOG_LEVEL`, `NVD_API_KEY` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Nist MCP Server

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

Remote serverstreamable-http

What is the Nist MCP Server?

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

What it actually does

Declarative tool, resource, and prompt definitions — single file per primitive, framework handles registration and validation
Unified error handling — handlers throw, framework catches, classifies, and formats
Pluggable auth: none, jwt, oauth
Swappable storage backends: in-memory, filesystem, Supabase, Cloudflare KV/R2/D1
Structured logging with optional OpenTelemetry tracing
STDIO and Streamable HTTP transports

Configuration

Bun v1.3.0 or higher (or Node.js v24+). - Optional: NVD API key — free, raises rate limit from 5 req/30s to 50 req/30s.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
nvd_search_cves	Search CVEs by keyword, severity, CWE, date range, or CISA KEV status.
nvd_get_cve	Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and references.
nvd_search_cpes	Search the NVD CPE dictionary by product keyword or partial match string.
nvd_audit_cpe	Find all CVEs affecting a specific product version by CPE name or virtual match string.
nvd_get_cve_history	Retrieve the change history for a CVE — score revisions, status transitions, and reference additions.

How to install the Nist MCP Server

{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "type": "stdio",
      "command": "bunx",
      "args": ["@cyanheads/nist-nvd-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info",
        "NVD_API_KEY": "your-api-key"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

Bun v1.3.0 or higher (or Node.js v24+). - Optional: NVD API key — free, raises rate limit from 5 req/30s to 50 req/30s.

Variable	Description	Required
MCP_TRANSPORT_TYPE	Configuration value read at startup.	Optional
MCP_LOG_LEVEL	Configuration value read at startup.	Optional
NVD_API_KEY	Credential the server authenticates with.	Yes

Example prompts to try

“Use Nist to nvd search cves.”
“Use Nist to nvd get cve.”
“Use Nist to nvd search cpes.”

Frequently asked questions

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.