VCSS Calculator MCP

CVSS 2.0、3.0、3.1、4.0に対応し、深刻度の分類も行う、決定論的なCVSS基本スコア計算用の軽量なオープンソースMCPサーバー。

ホスト型 MCP サーバー

npx add-mcp 'https://cvss.my.id/mcp'

Claude Code、Codex、Cursor などにインストールできます

ドキュメント

CVSS Calculator MCP

A lightweight CVSS Base Score calculator for AI agents, built with Go.

Website · Docs · MCP Registry

Calculate and validate CVSS 2.0, 3.0, 3.1, and 4.0 Base Scores through a single MCP tool: calculate_cvss. Supports local stdio and remote Streamable HTTP.

Quick Start

For agent-guided setup, copy this prompt to your AI agent:

Read https://get.cvss.my.id/LLM.txt and follow its instructions to set up CVSS Calculator MCP and offer to install its vulnerability assessment skill.

The agent will ask you to choose and approve a local or remote connection before making changes.

Option 1 — Install Locally

Linux / macOS:

curl -fsSL https://get.cvss.my.id/install.sh | bash

Windows (PowerShell, x64 or ARM64):

irm https://raw.githubusercontent.com/alfa-reza/cvss-calculator-mcp/main/install.ps1 | iex

The installer prints the binary location; add that directory to your PATH or use the full path in your MCP client.

Verify with cvss-calculator-mcp --version, then add the binary to your MCP client (choose one):

# Claude Code
claude mcp add --scope user cvss-calculator -- cvss-calculator-mcp

# Codex
codex mcp add cvss-calculator -- cvss-calculator-mcp

# OpenCode v2
opencode mcp add cvss-calculator --global -- cvss-calculator-mcp

Also available via GitHub Releases (including Windows) or go install github.com/alfa-reza/cvss-calculator-mcp/cmd/cvss-calculator-mcp@latest (Go 1.25+). Ensure the binary is in your PATH.

Option 2 — Free Remote MCP

No installation or API key required. Connect to https://cvss.my.id/mcp:

# Claude Code
claude mcp add --scope user --transport http cvss-calculator https://cvss.my.id/mcp

# Codex
codex mcp add cvss-calculator --url https://cvss.my.id/mcp

# OpenCode v2
opencode mcp add cvss-calculator --global --url https://cvss.my.id/mcp

Rate limit: 5 requests per minute per IP address. Use the local option to avoid this shared-service limit.

Other MCP clients (Cursor, Claude Desktop, VS Code, etc.)

Use cvss-calculator-mcp as a local stdio command, or https://cvss.my.id/mcp as a remote Streamable HTTP endpoint. Configuration formats depend on the client.

Cursor / Claude Desktop — local configuration (mcpServers):

{
  "mcpServers": {
    "cvss-calculator": { "command": "cvss-calculator-mcp" }
  }
}

For Cursor remote, use "url": "https://cvss.my.id/mcp" instead of the command entry.

VS Code — remote configuration (.vscode/mcp.json):

{
  "servers": {
    "cvss-calculator": { "type": "http", "url": "https://cvss.my.id/mcp" }
  }
}

See the client documentation for configuration locations and setup: Cursor · Claude Desktop · VS Code. Full copy-paste guides for all supported clients are available in the MCP docs.

Usage

Ask your connected AI assistant:

Calculate the CVSS 3.1 Base Score for CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The calculate_cvss tool accepts version and vector, returning a score and severity (for this example, 9.8 — Critical). Only complete Base vectors are supported; no CVE lookups or vulnerability scanning.

Vulnerability Assessment Skill

Install the optional skill to guide your agent in assessing discovered vulnerabilities, selecting CVSS metrics, and calculating Base Scores with this MCP server:

npx skills add alfa-reza/cvss-calculator-mcp --skill vulnerability-cvss-assessment

Choose your agent when prompted. Add --global to make the skill available across projects. The skill requires the MCP server configured as described in Quick Start. See its instructions and tool reference.

Self-Hosting

The Go binary uses stdio by default. For Streamable HTTP, run cvss-calculator-mcp --transport http (listens on 127.0.0.1:43871/mcp by default; customize with --listen).

License

Apache-2.0. CVSS is maintained by FIRST; this project is independent of FIRST.