vuln-nist-mcp-server

Purpose vuln-nist-mcp-server is a Model Context Protocol (MCP) server for querying the API endpoints of the NIST National Vulnerability Database (NVD). It provides callable tools to large language models (LLMs) for retrieving NVD/CVE REST API data and returns formatted text results, making them easy for LLMs to consume via the MCP protocol.

Main capabilities The server provides the following tools:

• get_temporal_context: Retrieves the current date and time context for time-relative queries (such as "this year", "last year", "6 months ago"), providing a current date mapping and examples of constructing date parameters. It is recommended to call this first when the user asks a time-relative question.
• search_cves: Searches CVE descriptions by keyword, with flexible date filtering. Parameters include keyword, resultsPerPage (default 20), startIndex (default 0), last_days (recent_days is deprecated), start_date, end_date. v1.1.0 adds support for absolute date ranges start_date and end_date. Date filtering priority is: start_date/end_date → last_days → default 30 days. Queries exceeding 120 days are automatically chunked into parallel requests. Results are sorted by publication date (newest first).
• get_cve_by_id: Retrieves detailed information for a specific CVE. Parameter cve_id. Returns CVE details, references, tags, and publication date.
• cves_by_cpe: Lists CVEs associated with a Common Platform Enumeration (CPE). Parameter cpe_name (requires full CPE 2.3 format), is_vulnerable (optional). Validates the CPE format before querying.
• kevs_between: Finds CVEs added to the CISA KEV catalog within a specified date range. Parameters kevStartDate, kevEndDate, resultsPerPage (default 20), startIndex (default 0). Queries exceeding 90 days are automatically chunked into parallel requests. Results are sorted by publication date (newest first).
• cve_change_history: Retrieves the change history of a CVE. Parametersare cve_id or (changeStartDate + changeEndDate), resultsPerPage (default 20), startIndex (default 0). Date range queries exceeding 120 days are automatically chunked into parallel requests. Results are sorted by change creation date (newest first).

Other features: time awareness (the new get_temporal_context tool supports accurate time-relative queries), flexible date filtering (supports relative last_days and absolute start_date/end_date ranges), improved result sorting (all results are in reverse chronological order, newest first), parallel processing (large date ranges are automatically split and processed concurrently), input validation (CPE format validation, date parsing, parameter sanitization), emoji indicators (✅ success, ❌ error, ⚠️ warning, 🔍 search, 🔥 KEV, 🌐 CPE, 🕘 history, 📅 time), comprehensive logging (detailed stderr logs for debugging), error handling (gracefully handles API errors, timeouts, and malformed responses).

Usage Environment requirements: Docker (recommended) or Python 3.11+; network access to NVD endpoints (services.nvd.nist.gov); an MCP-compatible client (such as Claude Desktop).

Run using Docker (recommended), which supports the following environment variables:

• NVD_BASE_URL: NVD API base URL (default:https://services.nvd.nist.gov/rest/json）
• NVD_VERSION: API version (default: /2.0)
• NVD_API_TIMEOUT: request timeout in seconds (default: 10)

In Claude Desktop or an MCP client, a typical usage flow includes: obtaining temporal context for time-relative queries; searching recent CVEs (relative time); searching CVEs using absolute date ranges; searching CVEs for "this year" (use get_temporal_context first); retrieving CVE details; checking CPE vulnerabilities; finding recent KEV additions.

Performance notes Queries with date ranges exceeding 90–120 days are automatically chunked to improve performance; parallel processing reduces the total query time for large date ranges; all chunked results are automatically sorted by publication date (newest first).

Security considerations No API key is required (the NVD endpoint is public); the container runs as a non-root user (mcpuser); input validation prevents injection attacks; sensitive data is not persistently stored; network capabilities are added via Docker flags only when necessary.

Use cases Suitable for scenarios such as security analysis, vulnerability investigation, CVE retrieval, CPE-associated vulnerability checking, CISA KEV catalog retrieval, and CVE change history tracking that require an LLM to query NVD/CVE data via the MCP protocol.

Limitations No data on fees, pricing, or specific results is provided in the content; relevant information is not currently available.