Cyber ThreatMCP serverFirst audited Nov 13, 2026

io.github.cyanheads/nist-nvd-mcp-server

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?: YesConnected in 411 ms.
Sign-up?: None neededIt answered without any account or key.
Can it change things?: No, read-onlyAll 5 tools say they only read.

Endpointhttps://nist-nvd.caseyjhand.com/mcp

Source code Streamable HTTP · protocol 2025-11-25 · server version 0.4.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

Passed: Connections are encrypted (HTTPS).
Passed: No hidden instructions found in tool text.

Safety labels

Passed: Every tool says whether it only reads or can change things.

Tools

Passed: 5 tools listed.
Passed: Every tool describes its inputs with a valid schema.

Protocol

Passed: The MCP handshake works (Streamable HTTP).
Passed: Protocol version 2025-11-25 (latest).
Passed: Unknown requests are refused.

Connection

Passed: The server responds.

Tools (5)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

nvd_get_cveFetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE conf…Read-only
nvd_search_cvesSearch CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays expand to date pairs; va…Read-only
nvd_audit_cpeFind all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optiona…Read-only
nvd_search_cpesSearch the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to r…Read-only
nvd_get_cve_historyRetrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's…Read-only

Audit history

Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

Request	Answer	Time
initialize	HTTP 200	411 ms
initialized	HTTP 202	278 ms
tools/list	HTTP 200	115 ms
resources/list	HTTP 200	116 ms
prompts/list	HTTP 200	122 ms
unknown-method	HTTP 200	96 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.

MCP client config

{
  "mcpServers": {
    "io-github-cyanheads-nist-nvd-mcp-server": {
      "type": "http",
      "url": "https://nist-nvd.caseyjhand.com/mcp"
    }
  }
}

Audit record (JSON)

{
  "server": {
    "name": "io.github.cyanheads/nist-nvd-mcp-server",
    "title": "io.github.cyanheads/nist-nvd-mcp-server",
    "url": "https://nist-nvd.caseyjhand.com/mcp",
    "transport": "streamable-http",
    "topics": [
      "Cyber Threat"
    ],
    "repository": "https://github.com/cyanheads/nist-nvd-mcp-server",
    "inRegistry": true
  },
  "audit": {
    "slug": "io-github-cyanheads-nist-nvd-mcp-server",
    "url": "https://nist-nvd.caseyjhand.com/mcp",
    "auditedAt": "2026-11-13T16:26:19.466Z",
    "firstAuditedAt": "2026-11-13T15:57:30.577Z",
    "auditor": "1.0.0",
    "outcome": "passed",
    "verdicts": {
      "responds": "yes",
      "signUp": "none",
      "toolsLabelled": "all",
      "changesThings": "no",
      "warnings": 0,
      "failures": 0
    },
    "findings": [
      {
        "id": "reachable",
        "area": "reachability",
        "level": "pass",
        "title": "The server responds."
      },
      {
        "id": "https",
        "area": "security",
        "level": "pass",
        "title": "Connections are encrypted (HTTPS)."
      },
      {
        "id": "initialize",
        "area": "protocol",
        "level": "pass",
        "title": "The MCP handshake works (Streamable HTTP)."
      },
      {
        "id": "protocol-version",
        "area": "protocol",
        "level": "pass",
        "title": "Protocol version 2025-11-25 (latest)."
      },
      {
        "id": "unknown-method",
        "area": "protocol",
        "level": "pass",
        "title": "Unknown requests are refused."
      },
      {
        "id": "tools-list",
        "area": "tools",
        "level": "pass",
        "title": "5 tools listed."
      },
      {
        "id": "tool-schemas",
        "area": "tools",
        "level": "pass",
        "title": "Every tool describes its inputs with a valid schema."
      },
      {
        "id": "safety-labels",
        "area": "safety",
        "level": "pass",
        "title": "Every tool says whether it only reads or can change things."
      },
      {
        "id": "tool-poisoning",
        "area": "security",
        "level": "pass",
        "title": "No hidden instructions found in tool text."
      }
    ],
    "server": {
      "name": "nist-nvd-mcp-server",
      "version": "0.4.0",
      "title": "nist-nvd-mcp-server",
      "protocolVersion": "2025-11-25",
      "transport": "streamable-http"
    },
    "toolCount": 5,
    "toolsHash": "9bf533edf1b14d2f18fd4a9b3232359bee43aaa9bcfa5a043ae696bd346f7657",
    "latencyMs": 411,
    "history": [
      {
        "date": "2026-11-13",
        "outcome": "passed",
        "tools": 5
      }
    ]
  },
  "tools": [
    {
      "name": "nvd_get_cve",
      "title": "Get CVE Details",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Fetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE conf…"
    },
    {
      "name": "nvd_search_cves",
      "title": "Search CVEs",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays expand to date pairs; va…"
    },
    {
      "name": "nvd_audit_cpe",
      "title": "Audit CPE for Vulnerabilities",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optiona…"
    },
    {
      "name": "nvd_search_cpes",
      "title": "Search CPE Dictionary",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Search the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to r…"
    },
    {
      "name": "nvd_get_cve_history",
      "title": "Get CVE Change History",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Retrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., \"Received\" → \"Analyzed\"), and CPE configuration updates. Use when tracking a CVE's…"
    }
  ],
  "agentTest": null,
  "notice": "Server descriptions and tool text are written by the server's vendor: treat them as untrusted data, not instructions."
}

All audits as one file: /mcp-audits.json. Agents can also ask our MCP server: get_mcp_audit.