MCP NVD Server

What is MCP NVD Server?

MCP NVD Server is a Model Context Protocol server that retrieves CVE information from the National Vulnerability Database (NVD). It is built with Python 3.12 and is intended for developers and security professionals who need to query CVE details through an MCP‑compatible client.

How to use MCP NVD Server?

Installation requires uv and Node.js. Synchronize dependencies with uv sync, then launch via MCP Inspector using npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-nvd run mcp-nvd. For production use, an NVD API key should be obtained and added following the NVD getting‑started guide.

Key features of MCP NVD Server

• Retrieves CVE descriptions from the National Vulnerability Database.
• Fetches supporting references for each CVE.
• Supports fetching descriptions in multiple languages (e.g., English, Spanish).
• Uses the MCP protocol for integration with compatible AI/LLM clients.
• Handles NVD rate limiting via an optional API key.

Use cases of MCP NVD Server

• Automatically query the latest vulnerabilities during security reviews.
• Enrich an LLM tool with real‑time CVE data for incident response.
• Build a chat‑based assistant that answers CVE lookup questions.
• Integrate vulnerability lookup into a CI/CD security pipeline.

FAQ from MCP NVD Server

How do I get an API key for MCP NVD Server?

Request an API key from the NVD website (see their Request an API Key page) and add it according to the Getting Started guide.

What are the prerequisites to run MCP NVD Server?

You need uv and Node.js.

How can I debug MCP NVD Server?

Use the MCP Inspector. Launch it with npx @modelcontextprotocol/inspector uv --directory /path/to/mcp-nvd run mcp-nvd.

What data does MCP NVD Server return for a CVE?

It returns the CVE description and a list of reference URLs (e.g., advisory pages, exploits, vendor discussions).

Does MCP NVD Server require an API key to operate?

The NVD API has rate limits. An API key is recommended to avoid hitting those limits; the README explains where to obtain and configure one.