mcpbeat Sign in

Nist Nvd MCP Server

answering

Nist Nvd MCP Server is answering right now. Last checked 6 min ago. 328 installs a week from npm. It exposes 5 tools. Last commit 20 Sep 2026.

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

Installs per day peak 265 · avg 47 · +187% w/w
a month agotoday
Uptime history 30 hours of history · worst hour 75%
30 hours agonow
100.0%
Uptime 24h
91 of 91 checks
5
Tools
read from the server
407 ms
Response time
average over 24h
328
Installs / week
npm and PyPI

Nist Nvd MCP Server does not always answer

Over the last week it answered 99.1% of our checks. We check every 15 minutes, so you hear about the next outage within the hour — not from your users.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 6 min ago.

run in your terminal
claude mcp add nist-nvd-mcp-server --transport http https://nist-nvd.caseyjhand.com/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.nist-nvd-mcp-server]
url = "https://nist-nvd.caseyjhand.com/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "nist-nvd-mcp-server": {
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}

This one needs environment variables set before it will start: NVD_API_KEY (NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key.), NVD_REQUEST_TIMEOUT_MS (Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key.), MCP_HTTP_HOST (The hostname for the HTTP server.), MCP_HTTP_PORT (The port to run the HTTP server on.), MCP_HTTP_ENDPOINT_PATH (The endpoint path for the MCP server.), MCP_AUTH_MODE (Authentication mode to use: 'none', 'jwt', or 'oauth'.), MCP_LOG_LEVEL (Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').). The author declared them in the registry entry; get the values from the project itself.

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

nvd
nvd_audit_cpe
Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. Use nvd_search_cpes first to resolve the correct CPE string for a product. Returns full CVE records.
nvd_get_cve
Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, and references. Up to 100 CVE IDs per call. For bulk lookups of more than 10 IDs, use brief: true — full records for 100 CVEs can exceed 1MB and exhaust context budgets.
nvd_get_cve_history
Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. Events are returned newest-first by default; pass order="oldest" for the CVE's earliest events. For the current record, call nvd_get_cve instead. The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD_API_KEY for reliable operation.
nvd_search_cpes
Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http_server:2.4.51:*:*:*:*:*:*:*) and must match exactly to audit the right product.
nvd_search_cves
Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).

Endpoints

URLTransportStateLatencyChecked
https://nist-nvd.caseyjhand.com/mcp streamable-http answering 402 ms 6 min ago

Alternatives to Nist Nvd MCP Server

same job, measured the same way
Emoji MCP
by mrfentmen

Search emoji by name or keyword locally. No network and no key.

local only
Luma Events
by alx1p

Discover events from Luma — search by category, city, distance, and keywords with calendar export

51 installs/wk local only
I
NextJobz Job Search
by ahmed-suman

Search jobs on NextJobz by keyword, location, work type, salary, and experience level.

1 tools answering
Jackpotkeywords MCP Server
by smythmyke

AI-powered keyword research, SEO audits, and AI-visibility scans via the JackpotKeywords REST API.

41 installs/wk local only
AIsa Keyword Volume & Ads
by aisa

Search volume, keyword ideas, difficulty, clickstream volumes and search trends.

answering
CalmSEO
by calmseo

SEO MCP server for keyword research, SERP analysis, audits, and Search Console workflows.

answering
RSS Keyword Monitor
by telemarkdigital-publisher

Search bounded RSS, Atom, and RDF feed matches by keyword or regex.

1 tools answering
Nvd Cve MCP
by mrfentmen

Search CVE vulnerability records from the NIST NVD database. No key required.

local only

Nist Nvd MCP Server — questions

Answers built from our own checks of this server.

What can Nist Nvd MCP Server do?
It exposes 5 tools, read directly from the server on our last check. Among them: nvd_audit_cpe, nvd_get_cve, nvd_get_cve_history, nvd_search_cpes, nvd_search_cves. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Nist Nvd MCP Server working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 407 ms. The bar chart above shows every period we have measured.
How do I connect Nist Nvd MCP Server?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Nist Nvd MCP Server need an API key?
No. Nist Nvd MCP Server completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Nist Nvd MCP Server?
It answers our handshake in 407 ms on average, which is faster than 39% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use Nist Nvd MCP Server?
The npm package @cyanheads/nist-nvd-mcp-server was installed 328 times in the last week. Week over week that is +187%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Nist Nvd MCP Server open source?
Yes — it is published under the Apache-2.0 licence, written in TypeScript, 1 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.