roadwy/cve-search_mcp
Free用于查询 CVE-Search API 的 MCP 服务器。提供全面访问 CVE-Search，浏览供应商/产品、按 ID 获取 CVE、获取最新 CVE。
FreeFree tier
About roadwy/cve-search_mcp
A Model Context Protocol (MCP) server for querying the CVE-Search API. Provides comprehensive access to CVE-Search, including browsing vendors and products, retrieving CVEs by ID, and fetching the last updated CVEs with CAPEC, CWE, and CPE expansions. Exposes tools to list all vendors, products per vendor, vulnerabilities per vendor/product, and database status. Designed for integration with MCP clients like Cline and Roo Code.
Key Features
List all vendors from CVE-Search
List all products associated with a vendor
Get vulnerabilities per vendor and product
Get details of a specific CVE by ID
Retrieve last 30 updated CVEs with CAPEC, CWE, and CPE expansions
Get database status information
Pros & Cons
Pros
- Free and open source under MIT license
- Comprehensive access to CVE-Search data
- Easy setup with uv and Python 3.10+
- Standard MCP protocol allows integration with various clients
- Lightweight and focused on CVE queries
Cons
- Requires Python 3.10+ and uv
- No official releases or versioning on GitHub
- Depends on external CVE-Search API availability
- Limited to data available in CVE-Search (no real-time CVE updates)
Best For
Vulnerability research and security analysisIntegrating CVE data into MCP-enabled applicationsAutomating CVE lookups in CI/CD pipelinesBuilding internal vulnerability dashboards with Cline or Roo Code
FAQ
What is cve-search_mcp?
It is a Model Context Protocol (MCP) server that provides a programmatic interface to query the CVE-Search API, allowing users to browse vendors, products, and retrieve CVE information.
How do I install and run the server?
Clone the repository, navigate to the directory, run 'uv sync' to install dependencies, then configure your MCP client (e.g., Cline or Roo Code) to execute 'uv --directory <path> run main.py'.
What data can I retrieve using this server?
You can retrieve a JSON list of all vendors, products for a vendor, vulnerabilities for a vendor/product pair, details for a specific CVE ID, the last 30 updated CVEs (with CAPEC, CWE, CPE expansions), and database status information.