NIST NVD MCP Server

MCP server exposing NIST NVD CVE search, CPE search, and CVSS v2/v3/v4 calculators as tools.

Documentation

NIST NVD MCP Server (`rl1987/nist-nvd-mcp-server`) Actor

MCP server exposing NIST NVD CVE search, CPE search, and CVSS v2/v3/v4 calculators as tools.

URL: https://apify.com/rl1987/nist-nvd-mcp-server.md
Developed by: R.L. (community)
Categories: MCP servers, Developer tools
Stats: 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
User rating: No ratings yet

Pricing

from $10.00 / 1,000 price for completing a tool calls

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A".

How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows.

AI agents and MCP clients — the Apify MCP server at https://mcp.apify.com (remote, streamable HTTP, OAuth on first use).
Agentic workflows and local Actor development — Agent Skills with the Apify CLI: npm install -g apify-cli, then apify login.
JavaScript/TypeScript projects — the official JS/TS client: npm install apify-client.
Python projects — the official Python client: pip install apify-client.
Any other language — the REST API.

For usage examples, see the API section below.

For more details, see Apify documentation as Markdown index and Markdown full-text.

README

NIST NVD MCP Server

An MCP server that exposes the NIST National Vulnerability Database to AI agents as tools — CVE search, CPE (product/platform) search, and native CVSS v2/v3.0/v3.1/v4.0 scoring, matching the data behind the NVD vulnerability search, CPE search, and CVSS v4 calculator pages. Built on FastMCP and deployed as an Apify Actor in Standby mode, so it runs as a persistent HTTP endpoint rather than a one-shot batch job.

Why use this?

Security teams, vulnerability management tools, and AI coding assistants need to look up CVE details, check what a given CPE (software/hardware identifier) is vulnerable to, and score custom vulnerability findings against the CVSS standard — without hand-rolling calls to NVD's REST API or re-deriving the CVSS math. This server wraps all three into MCP tools an agent can call directly, with built-in NVD rate-limit handling and retries. Running it on Apify gives you a hosted, always-on endpoint with API-token auth and usage-based billing, instead of self-hosting.

How to use

If you don't have one, create a free Apify account and grab your API token from console.apify.com/settings/integrations.
Open this Actor's page in Apify Console and copy its MCP endpoint URL from the API tab (it looks like https://rl1987--nist-nvd-mcp-server.apify.actor/mcp).
Connect your MCP client (Claude Code, Claude Desktop, an agent framework, etc.) to that URL over Streamable HTTP, passing your Apify API token as a Bearer token — see Connect to Claude Code below for the exact command.
Call search_cves, get_cve, search_cpes, or calculate_cvss_score from your agent. You're billed per completed tool call — see Pricing.

Connect to Claude Code

With the Actor's MCP endpoint URL and your Apify API token from above, run:

claude mcp add --transport http nist-nvd https://rl1987--nist-nvd-mcp-server.apify.actor/mcp \
  --header "Authorization: Bearer <YOUR_APIFY_API_TOKEN>"

Replace <YOUR_APIFY_API_TOKEN> with your own Apify API token — not the Actor owner's.

This adds the server at local scope (private, current project only). Add --scope user instead to make it available in every project on your machine.
Verify it connected: run claude mcp list, or type /mcp in an interactive Claude Code session — nist-nvd should show as connected with 4 tools.
Try it: ask Claude "look up CVE-2021-44228 in NVD" or "what's the CVSS v4 base score for CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" — it will call the tools directly.
Remove it later with claude mcp remove nist-nvd.

If you're on a team and want everyone to pick up this server automatically, commit a .mcp.json with just the URL (never the token) to your repo root:

{
  "mcpServers": {
    "nist-nvd": {
      "type": "http",
      "url": "https://rl1987--nist-nvd-mcp-server.apify.actor/mcp"
    }
  }
}

Each teammate then runs the claude mcp add ... --scope local command above once with their own token, which layers on top of the shared .mcp.json config without ever touching the repo.

Input

No Actor input is required to start the server — it runs in Standby mode and accepts MCP tool calls directly over HTTP. Optionally set the NVD_API_KEY environment variable (free from nvd.nist.gov/developers/request-an-api-key) to raise the NVD rate limit from 5 to 50 requests per 30 seconds.

Tools

search_cves — search CVE records by keyword, CVE ID, CPE name, CVSS v2/v3/v4 severity, CWE, vuln status, source, date range, or CISA KEV flag. Paginated.
get_cve — fetch a single CVE record by ID (e.g. CVE-2021-44228).
search_cpes — search CPE product/platform records by keyword, CPE match string, or CPE name ID. Paginated.
calculate_cvss_score — score any CVSS v2, v3.0, v3.1, or v4.0 vector string (version auto-detected from the vector prefix) and return the base/temporal/environmental scores and severities.

Output

Each tool returns a human-readable summary plus structured content. Example get_cve output:

{
  "id": "CVE-2021-44228",
  "sourceIdentifier": "security@apache.org",
  "published": "2021-12-10T10:15:09.143",
  "vulnStatus": "Analyzed",
  "description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP...",
  "cvssMetrics": {
    "cvssV3_1": { "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL" }
  },
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "references": [{ "url": "https://logging.apache.org/log4j/2.x/security.html", "source": "security@apache.org", "tags": ["Vendor Advisory"] }],
  "cisaKev": true
}

calculate_cvss_score output:

{
  "version": "3.1",
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "baseScore": 9.8,
  "baseSeverity": "Critical"
}

Pricing

This Actor uses Pay Per Event pricing: a flat fee per completed tool call (see .actor/pay_per_event.json). There is no charge for failed calls or for connecting/idling.

Tips

Pass a free NVD_API_KEY to avoid NVD's tighter unauthenticated rate limit (5 req/30s vs 50 req/30s with a key).
Use pub_start_date/pub_end_date or last_mod_start_date/last_mod_end_date (max 120-day span, ISO-8601) to page through large result sets instead of relying on keyword alone.
cpe_match_string accepts a partial CPE 2.3 URI, e.g. cpe:2.3:o:microsoft:windows_10, to browse a vendor/product family.

FAQ

This Actor only reads publicly published NIST NVD data via NVD's own REST API — it does not scrape or bypass any access controls. CVSS scoring is computed locally using a spec-conformant implementation, not by calling NIST's calculator pages. NVD API availability and rate limits are outside this Actor's control; see nvd.nist.gov/developers for their current terms. Report issues via the Actor's Issues tab.

Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

Actor input Schema

Actor input object example

{}

API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

JavaScript example

import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("rl1987/nist-nvd-mcp-server").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

Python example

from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("rl1987/nist-nvd-mcp-server").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

CLI example

echo '{}' |
apify call rl1987/nist-nvd-mcp-server --silent --output-dataset

MCP server setup

{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rl1987/nist-nvd-mcp-server"
        }
    }
}

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an Authorization: Bearer <APIFY_API_TOKEN> header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/pgx8ivC2euKGH5Hdc/builds/hgB4NdeZPO4YfkKdn/openapi.json

NIST NVD MCP Server

Documentation

NIST NVD MCP Server (rl1987/nist-nvd-mcp-server) Actor

Pricing

What's an Apify Actor?

How to integrate an Actor?

README

NIST NVD MCP Server

Why use this?

How to use

Connect to Claude Code

Input

Tools

Output

Pricing

Tips

FAQ

Did you find this useful?

Actor input Schema

Actor input object example

API

JavaScript example

Python example

CLI example

MCP server setup

OpenAPI specification

NIST NVD MCP Server (`rl1987/nist-nvd-mcp-server`) Actor