NIST Vulnerability API
MCP Server for Vulnerabilities API from NVD NIST
What is NIST Vulnerability API?
NIST Vulnerability API is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to mcp server for vulnerabilities api from nvd nist
MCP Server for Vulnerabilities API from NVD NIST
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- MCP Server for Vulnerabilities API from NVD NIST
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx vuln-nistConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use NIST Vulnerability API
The NIST Vulnerability MCP server is a Python-based server that provides Claude Desktop and other MCP clients with structured access to the NVD (National Vulnerability Database) API maintained by NIST. It exposes six tools for searching CVEs by keyword, retrieving CVE details by ID, finding vulnerabilities by CPE platform string, listing known exploited vulnerabilities (KEVs) within a date range, and fetching CVE change history—with no API key required for public NVD endpoints.
Prerequisites
- Docker installed (recommended), or Python 3.11+ as an alternative
- Network connectivity to https://services.nvd.nist.gov (no authentication required)
- An MCP-compatible client such as Claude Desktop
- Git installed to clone the repository
Clone the repository
Clone the vuln-nist-mcp-server repository from GitHub.
git clone https://github.com/HaroldFinchIFT/vuln-nist-mcp-server.git
cd vuln-nist-mcp-serverBuild the Docker image
Build the container image. Docker is the recommended runtime as it bundles all Python dependencies.
docker build -t vuln-nist-mcp-server .Test the server manually
Run the container interactively to confirm it starts without errors before connecting it to Claude Desktop.
docker run --rm -it vuln-nist-mcp-serverAdd to Claude Desktop configuration
Register the Docker-based server in your Claude Desktop config. No API key environment variables are required. Optional variables can tune the NVD endpoint and timeout.
{
"mcpServers": {
"vuln-nist": {
"command": "docker",
"args": ["run", "--rm", "-i", "vuln-nist-mcp-server"],
"env": {
"NVD_BASE_URL": "https://services.nvd.nist.gov/rest/json",
"NVD_VERSION": "/2.0",
"NVD_API_TIMEOUT": "10"
}
}
}
}Restart Claude Desktop and verify
Restart Claude Desktop and ask it to look up a well-known CVE (e.g., CVE-2021-44228, the Log4Shell vulnerability) to confirm the server is responding correctly.
NIST Vulnerability API Examples
Client configuration
Claude Desktop configuration for the NIST Vulnerability MCP server using Docker.
{
"mcpServers": {
"vuln-nist": {
"command": "docker",
"args": ["run", "--rm", "-i", "vuln-nist-mcp-server"],
"env": {
"NVD_BASE_URL": "https://services.nvd.nist.gov/rest/json",
"NVD_VERSION": "/2.0",
"NVD_API_TIMEOUT": "10"
}
}
}
}Prompts to try
Example natural-language prompts for querying NVD vulnerability data.
- "Search for CVEs related to Microsoft Exchange published in the last 7 days"
- "Get the full details for CVE-2021-44228 (Log4Shell)"
- "Find all vulnerabilities for Microsoft Exchange Server 2019 using its CPE string"
- "List known exploited vulnerabilities (KEVs) added between January 1 and March 31 2025"
- "Show me the change history for CVE-2024-21413"
- "What is the CVSS score and severity for CVE-2023-4863?"Troubleshooting NIST Vulnerability API
Request timeout or connection refused to NVD
The NVD API enforces rate limits (5 requests per 30 seconds without an API key). If you receive timeouts, increase NVD_API_TIMEOUT to 30 and space out your queries. For higher throughput, register for a free NVD API key at nvd.nist.gov/developers/request-an-api-key and set it in the NVD_API_KEY environment variable if the server supports it.
Docker image not found when Claude tries to start the server
Confirm you built the image with 'docker build -t vuln-nist-mcp-server .' and that Docker Desktop is running. Verify the image exists with 'docker images | grep vuln-nist-mcp-server'.
search_cves returns no results for a keyword
NVD keyword search is case-insensitive but requires exact term matches. Try broader terms (e.g., 'Exchange' instead of 'MS Exchange') or use the cves_by_cpe tool with a specific CPE string for more targeted lookups.
Frequently Asked Questions about NIST Vulnerability API
What is NIST Vulnerability API?
NIST Vulnerability API is a Model Context Protocol (MCP) server that mcp server for vulnerabilities api from nvd nist It connects AI assistants to external tools and data sources through a standardized interface.
How do I install NIST Vulnerability API?
Follow the installation instructions on the NIST Vulnerability API GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with NIST Vulnerability API?
NIST Vulnerability API works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is NIST Vulnerability API free to use?
Yes, NIST Vulnerability API is open source and available under the MIT license. You can use it freely in both personal and commercial projects.
NIST Vulnerability API Alternatives — Similar Security Servers
Looking for alternatives to NIST Vulnerability API? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up NIST Vulnerability API in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use NIST Vulnerability API?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.