nist-nvd-mcp-server

---

Tools

Five tools for vulnerability research, CPE auditing, and change tracking against the NIST NVD API 2.0:

Tool	Description
nvd_search_cves	Search CVEs by keyword, severity, CWE, date range, or CISA KEV status.
nvd_get_cve	Fetch one or more CVEs by ID — full CVSS scores, CWE, CPE configs, KEV fields, and references.
nvd_search_cpes	Search the NVD CPE dictionary by product keyword or partial match string.
nvd_audit_cpe	Find all CVEs affecting a specific product version by CPE name or virtual match string.
nvd_get_cve_history	Retrieve the change history for a CVE — score revisions, status transitions, and reference additions.

nvd_search_cves

The primary discovery tool for vulnerability surveillance and triage workflows.

• Full-text keyword search across CVE descriptions (AND-semantics across words)
• Severity filter by CVSS v2/v3/v4 label (LOW, MEDIUM, HIGH, CRITICAL)
• CWE weakness filter (e.g., CWE-79, NVD-CWE-Other)
• CISA KEV filter — limit results to known-exploited vulnerabilities
• Convenience date shorthands: pubDays and lastModDays for "last N days" queries
• Explicit ISO 8601 date range parameters (pubStartDate/pubEndDate, etc.) with 120-day max span
• Auto-clamps convenience date params that exceed 120 days and reports clamped values in queryMeta
• Pagination via limit (up to 2000) and offset
• Results are always brief; call nvd_get_cve for full detail

---

nvd_get_cve

Fetch one or more CVEs by ID with full detail or brief summaries.

• Batch up to 100 CVE IDs per call
• Full mode: all CVSS scores across v2.0, v3.0, v3.1, and v4.0; CWE weaknesses; CPE configurations; CISA KEV fields; references
• Brief mode (brief: true): ID, status, top severity, KEV name — recommended for batches larger than 10
• includeReferences: false to strip the references array and reduce response size
• Per-ID parity check: queryMeta.missingIds lists any requested IDs NVD didn't return

---

nvd_search_cpes

Look up product identifiers before auditing.

• Keyword search (e.g., "apache http server", "openssl") or partial CPEv2.3 pattern
• Returns full CPE name, human-readable title, deprecation status, and superseding CPEs
• Pagination up to 10,000 entries — narrow the keyword when totalResults > returned
• Use this before nvd_audit_cpe — CPE names are arcane strings; guessing audits the wrong product

---

nvd_audit_cpe

Full CVE audit for a specific product version.