Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE. The nist mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 7 defined tools rather than through you.
Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Everything the assistant can do here goes through one of these:
nvd_search_cves — Search CVEs by keyword, severity, CWE, date range, or CISA KEV statusnvd_get_cve — Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and referencesnvd_search_cpes — Search the NVD CPE dictionary by product keyword or partial match stringnvd_audit_cpe — Find all CVEs affecting a specific product version by CPE name or virtual match stringnvd_get_cve_history — Retrieve the change history for a CVE — score revisions, status transitions, and reference additionsPrerequisites — The Prerequisites tool exposed by this serverInstallation — The Installation tool exposed by this serverYou will need 3 environment variables: MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, NVD_API_KEY. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Among the file and storage access options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Nist's toolset — nvd_search_cves, nvd_get_cve, nvd_search_cpes and 4 more — is a fair guide to whether it matches your workflow. It is maintained by cyanheads; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Nist's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| nvd_search_cves | Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. |
| nvd_get_cve | Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and references. |
| nvd_search_cpes | Search the NVD CPE dictionary by product keyword or partial match string. |
| nvd_audit_cpe | Find all CVEs affecting a specific product version by CPE name or virtual match string. |
| nvd_get_cve_history | Retrieve the change history for a CVE — score revisions, status transitions, and reference additions. |
| Prerequisites | The Prerequisites tool exposed by this server. |
| Installation | The Installation tool exposed by this server. |
{
"mcpServers": {
"nist-nvd-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/nist-nvd-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"NVD_API_KEY": "your-api-key"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| MCP_TRANSPORT_TYPE | Configuration value read at startup. | Optional |
| MCP_LOG_LEVEL | Configuration value read at startup. | Optional |
| NVD_API_KEY | Credential the server authenticates with. | Yes |
Scoped local file access — read, write, search and reorganise files in directories you explicitly allow.
Search and read your Drive — Docs, Sheets and files become context your assistant can actually use.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Chat with your second brain — search, read and write vault notes through the Local REST API.
Connects AI models to an Obsidian knowledge base for direct access and manipulation of notes and folders.