MCP server for searching and retrieving CVE vulnerability information from NVD
MCP server for searching and retrieving CVE vulnerability information from NVD. Exposed over MCP by the nvd cve mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
A Model Context Protocol (MCP) server for retrieving and displaying CVE vulnerability information from the National Vulnerability Database (NVD). Features dual data sources with NVD API and web scraping fallback.
Everything the assistant can do here goes through one of these:
Prerequisites — The Prerequisites tool exposed by this serverInstallation goes through your MCP client rather than a global install: point it at nvd-cve-mcp-server on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Nvd Cve's toolset — Prerequisites — is a fair guide to whether it matches your workflow. It is maintained by socteam-ai; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Nvd Cve's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Prerequisites | The Prerequisites tool exposed by this server. |
{
"mcpServers": {
"nvd-cve": {
"command": "npx",
"args": ["-y", "nvd-cve-mcp-server"]
}
}
}Configuration as documented by the project. Restart the client after saving.
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.