CVE Intelligence MCP Server

A Model Context Protocol (MCP) server providing CVE vulnerability lookup tools backed by the NVD CVE API 2.0. Available as both an MCP server (stdio transport) and standalone HTTP REST API.

Features

• MCP Tools
  • search_cves - Search CVEs by keyword with optional severity and date filters
  • get_cve - Get detailed information about a specific CVE
• Production-Ready
  • In-memory caching with configurable TTL
  • Rate limiting per NVD guidelines (automatic with/without API key)
  • Automatic retries with exponential backoff
  • Defensive parsing and strict input validation
• Dual Transport
  • MCP server via stdio for AI assistant integration
  • HTTP REST API for web/programmatic access
• OpenAI Compatible - Function schema endpoint at /openai/tools

Requirements

• Go 1.24+
• Optional: NVD API key for higher rate limits

Installation

git clone https://github.com/cve-mcp-server/cve-mcp-server.git
cd cve-mcp-server

go mod tidy

# Build MCP server (stdio transport)
go build -o cve-mcp-server ./cmd/server

# Build HTTP server (REST API)
go build -o cve-http-server ./cmd/http-server

Configuration

Environment Variable	Description	Default
NVD_API_KEY	NVD API key for higher rate limits (50 req/30s vs 5 req/30s)	-
PORT	HTTP server port	8080
CACHE_TTL	Cache time-to-live	1h
GIN_MODE	Gin framework mode (debug, release)	release

Usage

MCP Server (stdio)

# Without API key (public rate limits: 5 requests per 30 seconds)
./cve-mcp-server

# With API key (higher rate limits: 50 requests per 30 seconds)
NVD_API_KEY=your-api-key ./cve-mcp-server

HTTP Server (REST API)

# Start server
./cve-http-server

# With custom port
PORT=3000 ./cve-http-server

# With API key
NVD_API_KEY=your-api-key ./cve-http-server

Endpoints:

Method	Endpoint	Description
POST	/search_cves	Search CVEs by keyword
POST	/get_cve	Get CVE details by ID
GET	/openai/tools	OpenAI function schema
GET	/health	Health check

---

MCP Tools

search_cves

Search CVEs by keyword and optional filters.

Parameters:

Parameter	Type	Required	Description
keyword	string	✓	Search keyword to find in CVE descriptions
severity	string		Filter by CVSS v3 severity: LOW, MEDIUM, HIGH, CRITICAL
published_start	string		Filter CVEs published on or after this date (RFC3339)
published_end	string		Filter CVEs published on or before this date (RFC3339)
limit	integer		Maximum results to return (default: 10, max: 100)

Example Request (HTTP):

curl -X POST http://localhost:8080/search_cves \
  -H "Content-Type: application/json" \
  -d '{"keyword": "log4j", "severity": "CRITICAL", "limit": 5}'

Example Response:

{
  "results": [
    {
      "cve_id": "CVE-2021-44228",
      "description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages…",
      "severity": "CRITICAL",
      "cvss_score": 10.0,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "published": "2021-12-10T10:15:09.143",
      "last_modified": "2023-04-03T20:15:07.510"
    }
  ],
  "total_found": 1
}

Behavior:

• Returns at most limit results
• If CVSS/severity is unavailable, sets severity: "UNKNOWN" and omits score fields
• Descriptions are truncated to 240 characters at word boundaries

---

get_cve

Get detailed information about a specific CVE.

Parameters:

| Parameter | Type | Require

... View full README on GitHub