HaroldFinchIFT/vuln-nist-mcp-server

vuln-nist-mcp-server

A Model Context Protocol (MCP) server for querying NIST National Vulnerability Database (NVD) API endpoints.

Purpose

This MCP server exposes tools to query the NVD/CVE REST API and return formatted text results suitable for LLM consumption via the MCP protocol. It includes automatic query chunking for large date ranges and parallel processing for improved performance.

Base API docs: https://nvd.nist.gov/developers/vulnerabilities

Features

Available Tools

• get_temporal_context - Get current date and temporal context for time-relative queries

  • Essential for queries like "this year", "last year", "6 months ago"
  • Provides current date mappings and examples for date parameter construction
  • USAGE: Call this tool FIRST when user asks time-relative questions

• search_cves - Search CVE descriptions by keyword with flexible date filtering

  • Parameters: keyword, resultsPerPage (default: 20), startIndex (default: 0), last_days (recent_days has been deprecated), start_date, end_date
  • New in v1.1.0: Support for absolute date ranges with start_date and end_date parameters
  • Date filtering priority: start_date/end_date → last_days → default 30 days
  • Auto-chunks queries > 120 days into parallel requests
  • Results sorted by publication date (newest first)

• get_cve_by_id - Retrieve detailed information for a specific CVE

  • Parameters: cve_id
  • Returns: CVE details, references, tags, and publication dates

• cves_by_cpe - List CVEs associated with a Common Platform Enumeration (CPE)

  • Parameters: cpe_name (full CPE 2.3 format required), is_vulnerable (optional)
  • Validates CPE format before querying

• kevs_between - Find CVEs added to CISA KEV catalog within a date range

  • Parameters: kevStartDate, kevEndDate, resultsPerPage (default: 20), startIndex (default: 0)
  • Auto-chunks queries > 90 days into parallel requests
  • Results sorted by publication date (newest first)

• cve_change_history - Retrieve change history for CVEs

  • Parameters: cve_id OR (changeStartDate + changeEndDate), resultsPerPage (default: 20), startIndex (default: 0)
  • Auto-chunks date range queries > 120 days into parallel requests
  • Results sorted by change creation date (newest first)