CVE Search MCP Server

A Model Context Protocol (MCP) server for CVE and vulnerability searching, optimized for PR review scenarios. Helps developers and security teams identify the latest CVEs and vulnerabilities — including those that postdate an LLM's training data.

Features

• 8 tools covering CVE lookup, bulk scanning, keyword search, product search, recent CVEs, high-severity alerts, database stats, and detailed CVSS breakdowns
• Multi-source: NVD, GitHub Advisory, OSV, CIRCL — searched concurrently and deduplicated
• Smart normalization: "Node.js", "Spring Boot", "log4j2" all resolve correctly
• Optional auth: GITHUB_TOKEN and NVD_API_KEY for higher rate limits
• 3 transports: stdio (default), SSE, Streamable HTTP

Installation

Prerequisites

• Python 3.10+
• uv package manager

Install

cd cve-search
uv sync

Development Setup

uv sync --extra dev
uv run --extra dev pytest
uv run black src/
uv run ruff check src/

Configuration

Env Var	Default	Description
GITHUB_TOKEN	none	GitHub personal access token. Raises GitHub Advisory API rate limit from 60 to 5000 req/hr.
NVD_API_KEY	none	NVD API key. Raises rate limit from 5 to 50 req/30s. Get one at nvd.nist.gov.
CVE_SEARCH_TIMEOUT	20	HTTP request timeout in seconds.
CVE_SEARCH_MAX_RESULTS	100	Maximum results returned per tool call.

Running

# stdio (default — for Claude Desktop/IDE)
uv run python main.py

# SSE
uv run python main.py --transport sse --host 127.0.0.1 --port 8000

# Streamable HTTP (MCP spec 2025-06-18+)
uv run python main.py --transport streamable-http --host 127.0.0.1 --port 8000

Claude Desktop Config

{
  "mcpServers": {
    "cve-search": {
      "command": "uv",
      "args": ["--directory", "/path/to/cve-search", "run", "python", "main.py"],
      "env": {
        "GITHUB_TOKEN": "your-token-here",
        "NVD_API_KEY": "your-key-here"
      }
    }
  }
}

Tools

Tool	Description	Speed
search_cve_by_id	Look up a specific CVE by ID (e.g. CVE-2021-44228)	Fast
bulk_cve_lookup	Look up up to 20 CVE IDs in one call — ideal for scanning PR dependency lists	Fast
search_vulnerabilities_by_product	Search by vendor/product name (e.g. vendor="apache", product="struts")	Slow (10-15s)
get_recent_cves	Get CVEs from the last N days	Fast
check_high_severity_cves	Get CVSS ≥ 7.0 CVEs from the last N days	Fast
search_by_keyword	Smart multi-source keyword search (NVD + GitHub Advisory + OSV)	Fast
get_vulnerability_stats	Database stats: total CVE count, last updated timestamp	Fast
cvss_score_lookup	Detailed CVSS v3/v4 breakdown for a CVE (base score, vector string, per-metric)	Fast

PR Review Workflow

Scan a list of CVE IDs from a dependency audit

bulk_cve_lookup(["CVE-2021-44228", "CVE-2023-44487", "CVE-2024-12345"])

Search for vulnerabilities in a technology being introduced

search_by_keyword("spring boot")

Check high-severity CVEs published this week

check_high_severity_cves(7)

Get detailed CVSS breakdown for a flagged CVE

cvss_score_lookup("CVE-2021-44228")

Project Structure

cve-search/
├── src/mcp_server_cve_search/
│   ├── config.py            # Config from env vars
│   ├── server.py            # FastMCP app + transport dispatch
│   ├── tools/               # One module per tool group
│   │   ├── cve_lookup.py    # search_cve_by_id, bulk_cve_lookup
│   │   ├── product_search.py
│   │   ├── recent_cves.py   # get_recent_cves, check_high_severity_cves
│   │   ├── keyword_search.py
│   │   ├── stats.py         # get_vulnerability_stats
│   │   └── cvss.py          # cvss_score_lookup
│   ├── sources/             # One client per API
│   │   ├── circl.py         # CIRCL CVE Search
│   │   ├── nvd.py           # NVD/NIST (optional API key)
│   │   ├── github.py        # GitHub Advisory (optional token)
│   │   └── osv.py           # OSV (Google)
│   └── utils/
│       ├── severity.py      # CVSS score helpers
│       ├── normalization.py # Keyword normalization + tech mappings
│       └── formatting.py    # Summary/alert formatting
├── tests/
├── examples/
├── main.py
├── test_server.py           # Manual live-API integration test
└── pyproject.toml

Data Sources

Source	URL	Notes
CIRCL CVE Search	cve.circl.lu	Primary source; no auth required
NVD (NIST)	nvd.nist.gov	Richest CVSS data; optional API key
GitHub Advisory	github.com/advisories	Optional token for higher rate limits
OSV (Google)	osv.dev	Open source vulnerability database

License

MIT License