Happy slice of mcp pizzaMCP.pizza

cve-search_mcp

MCP.Pizza Chef: roadwy

Six read-only lookups sit behind this, all pointed at CIRCL's free public vulnerability database — no account, no key, no cost. You can pull the full record for one flaw, list every product a vendor makes, see what has been reported against a specific product, or fetch the newest entries. Nothing can be changed or deleted. One warning: the 'all vendors' lookup returns about a megabyte of raw names and will swamp a conversation, so name a vendor or product instead.

Unmaintained · No commits in 12 months.
Coding
Web/Research

Use This MCP server To

Look up exactly what a named security flaw affects Check recent flaws reported against software I use See the newest vulnerabilities published this week Find which products a vendor has known issues in Read the official write-up for a flaw someone mentioned

README

MseeP.ai Security Assessment Badge

CVE-Search MCP Server

CVE-SEARCH_MCP

cve-search_mcp MCP server

A Model Context Protocol (MCP) server for querying the CVE-Search API. This server provides comprehensive access to CVE-Search, browse vendor and product、get CVE per CVE-ID、get the last updated CVEs.

Requirements

  • python 3.10+
  • uv
  • Cline、Roo Code etc

Tools

  • To get a JSON with all the vendors
  • To get a JSON with all the products associated to a vendor
  • To get a JSON with all the vulnerabilities per vendor and a specific product
  • To get a JSON of a specific CVE ID
  • To get a JSON of the last 30 CVEs including CAPEC, CWE and CPE expansions
  • To get more information about the current databases in use and when it was updated

Quick Start

  1. Git clone this repository
git clone https://github.com/roadwy/cve-search_mcp.git
  1. Install the dependencies
cd cve-search_mcp
uv sync

3.Add to your mcp client(vscode with cline/roo code) configuration file, modify the "YOU_CVE_SEARCH_MCP_DIR_PATH" as you self dir.

    "cve-search_mcp": {
      "command": "uv",
      "args": [
        "--directory",
        "YOU_CVE_SEARCH_MCP_DIR_PATH",
        "run",
        "main.py"
      ],
      "disabled": false,
      "autoApprove": []
    }

Reference

https://github.com/cve-search/cve-search

cve-search_mcp FAQ

Do I need to pay or sign up for anything?
No. It queries CIRCL's free public vulnerability service, and the code sends no key or login of any kind.
Can it change or delete anything?
No. All six lookups only read, so there is nothing here that can break your data.
Can I use this to check whether a flaw affects me?
Yes for the research half — it pulls the full record so you can see the affected software and versions. It cannot scan your own machines to tell you if you are running them.
How hard is setup?
Harder than most. Nothing is published to a package registry, so you download the project folder yourself, run a Python install step, and point your settings at that exact folder.
Why did my chat suddenly fill with thousands of names?
That is the 'all vendors' lookup, which returns roughly a megabyte of raw text. Ask about one vendor by name instead.
Which apps does it work in?
The instructions cover VS Code with Cline or Roo Code, and the same local command works in any assistant that accepts a local tool setup.
Is it still being worked on?
The project itself has been quiet since July 2025, about a year. The public database it queries is run by someone else and was still answering when we checked.