NVD MCP Server

Created By

sockcymbal8 months ago

Content

NVD MCP Server

Stay ahead of security threats without breaking your flow. The NVD MCP Server is your gateway to the National Vulnerability Database (NVD), seamlessly integrated into AI-powered development environments like Windsurf. Ask questions in plain English, get real-time vulnerability data, and keep your code secure—all from within your IDE. Built on the Model Context Protocol (MCP), this server bridges conversational queries with the NVD's extensive security database, empowering developers to stay informed effortlessly.

Features

CVE Details Lookup: Ask "What's the scoop on CVE-2023-1234?" and get a detailed breakdown—description, CVSS score, severity, and more.
Keyword Search: Type "Find CVEs related to Apache" to uncover vulnerabilities tied to specific technologies or keywords.
Recent CVEs: Use "Show me the latest CVEs from the past week" to stay updated on newly reported vulnerabilities.
Severity Filtering: Filter with "List critical vulnerabilities" to zero in on the most urgent security risks.

Requirements

Python 3.8 or higher
Dependencies:
- mcp
- httpx
- python-dotenv

Install them with: pip install mcp httpx python-dotenv

Installation

Clone the repository:

cd nvd-mcp-server

Set up a virtual environment:

source venv/bin/activate  # On Windows: venv\Scripts\activate

Install dependencies:

pip install -r requirements.txt

Configure your NVD API key:

Request a key from NVD API Key Request: https://nvd.nist.gov/developers/request-an-api-key
Create a keys.env file in the project root with: NVD_API_KEY=your_api_key_here

Usage

Launch the server:

python nvd_mcp.py --transport stdio

Connect your client/IDE/agent to communicate with this MCP server.

Eg, if you're on Claude Desktop, go to Claude > Settings > Developer > Edit Config > claude_desktop_config.json to include the following:

{
  "mcpServers": {
    "nvd": {
      "command": "uv",
      "args": ["--directory", "/Path to nvd_mcp directory", "run", "nvd_mcp.py"]
    }
  }
}

Query away with natural language:

"What's the deal with CVE-2023-1234?" Returns detailed CVE info, like description and severity.
"Any recent critical vulnerabilities?" Lists the latest CVEs with critical severity.
"Search for CVEs mentioning Apache." Shows vulnerabilities related to Apache.

Configuration

API Key: Store your NVD API key securely in keys.env as NVD_API_KEY=your_api_key_here.
Transport Mechanism:
- Default: --transport stdio for local use.
- For networked setups, use --transport http (ensure proper security, like HTTPS).