CVE Intelligence MCP

CVE vulnerability intelligence for AI agents — NVD data, CVSS scoring, affected software, and vulnerability trend analysis.

---

1. Purpose Statement

CVE Intelligence MCP is an MCP (Model Context Protocol) server that gives AI agents direct access to the National Vulnerability Database (NVD) — 348,000+ CVEs with CVSS scores, affected software (CPE), references, and weakness classifications. AI agents performing security research, vulnerability triage, penetration testing, or supply chain risk assessment query CVE details, severity rankings, and vendor advisories without requiring API keys or navigating NVD's interface.

Built for: AI security researchers triaging vulnerabilities, pentesters looking up CVE impact, developers auditing dependencies, compliance teams assessing exposure, and AI agents doing supply chain security analysis.

---

2. Quick Start

Add to your MCP client:

{
  "mcpServers": {
    "cve-intelligence-mcp": {
      "url": "https://red-cars--cve-intelligence-mcp.apify.actor/mcp"
    }
  }
}

AI agents can now search 348,000+ CVEs, get detailed vulnerability profiles with CVSS scores and affected software, analyze severity trends, and get vendor-specific advisories.

---

Comparison

See how CVE Intelligence MCP compares to manual research: ./COMPARISON.md

---

3. When to Call This MCP

Use CVE Intelligence MCP when you need to:

• Look up a specific CVE — full details including CVSS score, description, affected software, references
• Search vulnerabilities by keyword — find all CVEs related to a specific product or component
• Get recent vulnerabilities — stay current with newly published CVEs from the last N days
• Analyze by severity — get all critical/high CVEs ranked by score for prioritization
• Find vendor advisories — get all known vulnerabilities affecting a specific vendor's products

---

4. What Data Can You Access?

Data Type	Source	Example
CVE profiles	NVD (NIST)	CVE ID, description, status, dates
CVSS metrics	NVD	v3.1/v3.0/v2.0 scores, severity, vector
Affected software	NVD CPE	Product, vendor, version ranges
References	NVD	Vendor advisories, exploitDB, patches
Weakness types	CWE	CWE classification

---

5. Why Use CVE Intelligence MCP?

The problem: Researching CVE severity, affected products, and remediation priority requires navigating NVD's web interface or API — which has aggressive rate limits (6 req/min), no batch search, and returns raw JSON that needs significant processing. For security researchers, pentesters, and AI agents doing supply chain analysis, this data is essential for triage and prioritization. Manual CVE research takes hours across NVD, CVE.org, and vendor advisories.

The solution: AI agents use CVE Intelligence MCP to get instant, structured CVE intelligence — detailed vulnerability profiles with CVSS scoring and affected software lists, severity-ranked vulnerability analysis, recent CVE feeds, and vendor-specific advisories. This is the CVE intelligence layer for AI agents doing security research, penetration testing, and supply chain risk assessment.

---

6. Tools

search_cves

Search NVD CVE database by keyword, severity, or year range. Returns CVE IDs, descriptions, CVSS scores, and affected software.

search_cves(query="log4j", severity="CRITICAL", resultsPerPage=10)

get_recent_cves

Get recently published CVEs from the last N days. Useful for staying current on emerging vulnerabilities.

get_recent_cves(maxResults=10, daysBack=7)

get_cve_details

Get detailed information for a specific CVE including full description, CVSS metrics, CPE affected software list, references, and weakness types.

get_cve_details(cveId="CVE-2024-3094")

analyze_cvss_scores

Analyze CVEs by CVSS score threshold. Returns critical and high severity vulnerabilities ranked by score, useful for prioritizing remediation.

analyze_cvss_scores(minScore=7, maxResults=50)

get_vendor_advisories

Search CVEs by vendor or product name. Returns all known vulnerabilities affecting products from that vendor.

get_vendor_advisories(vendor="apache", product="log4j", maxResults=20)

---

7. Pricing

Tool	Price
search_cves	$0.03
get_recent_cves	$0.02
get_cve_details	$0.02
analyze_cvss_scores	$0.05
get_vendor_advisories	$0.03

All prices in USD per tool call. No API keys required — NVD is fully open.

---

8. Setup

1. Clone or download this actor
2. Run: npm install
3. Start: npm start
4. Add to your MCP client using the URL above

No API keys required. NVD's public API is freely accessible.