Ccve.now MCP (remote)

Vendor-hosted New / early find
New / early find: first tested 2026-11-02. Sazabi's free cve.now vulnerability feed as a hosted MCP endpoint (https://mcp.cve.now/mcp, no sign-in, 5 tools). Repo sazabi/cve.now (docs only, created 2026-10-22, 116 GitHub stars when tested). Real read-only calls (no LLM, no credentials): get_vulnerability CVE-2021-44228, search for MCP vulnerabilities and check_stack lodash 4.17.20 all returned data. Server source is not public, so license scores 0. list_feed and get_leaderboard were not called.
Tool-call test (2026-11-02, direct MCP stdio client, no LLM): pass. 3 of 3 read-only calls passed on the live endpoint: get_vulnerability, search and check_stack. No credentials. Evidence: live endpoint probe, Nov 2, 2026.
Sazabi-hosted public endpoint, no sign-in. The server source isn't public: github.com/sazabi/cve.now holds docs only (synced from Sazabi's private monorepo). Listed as a hosted remote (Our review, Nov 1, 2026).
Sources: https://cve.now/#mcp · https://github.com/sazabi/cve.now · https://github.com/sazabi/cve.now/commit/028836f8cf

Transport (tested 2026-11-02): Streamable HTTP

Score 65/100 · Tools 5 · Token cost ~1,161 · Compare · Last tested 2026-11-02 · Server version 0.1.0 · Remote endpoint https://mcp.cve.now/mcp (streamable-http)

Summary: cve.now MCP (remote) completed an MCP handshake without credentials and exposed 5 tools.

Evidence summary

Handshake

pass

Tools listed

5

Context cost

1,161 model-visible tokens (name, description, inputSchema; tiktoken cl100k_base)
Extra payload (sent by the server, usually not read by the model): 0 tokens; raw tools/list total 1,161. Clients differ in what they forward. ranking · add up your servers' context cost

Login

No key needed for the tools we called

Tested

2026-11-02

Test results

Local-model readiness

Schema context cost: ~1,161 tokens for 5 tools (4,770 bytes) · about 14% of an 8k context. Method: tiktoken cl100k_base over compact JSON of name+description+inputSchema (approximate).

Small-model friendly (schema heuristic, not a model result): unknown.

Small-model task runs: Not yet tested.

What we tested and what we didn't

Methodology: how we test (vendor-hosted rule). A high score means it responds and its vendor documents and dates it, not that it is safe to give it access to your data.

{
  "name": "cve-now-remote",
  "version": null,
  "registry": "remote",
  "status": "working",
  "tested": "2026-11-02",
  "tools_count": 5,
  "tools_schema_tokens_est": 1161,
  "deprecated": false,
  "archived": null,
  "tests": {
    "install": [
      "pass",
      20,
      "Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) + `tools/list` over streamable-http succeeded with no credentials; 5 tools listed in 0.6s. Tool calls may still need a key."
    ],
    "maintenance": [
      "pass",
      25,
      "Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC)."
    ],
    "docs": [
      "pass",
      15,
      "official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now)."
    ],
    "license": [
      "fail",
      0,
      "A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service)."
    ]
  }
}

Install

https://mcp.cve.now/mcpCopy

Tools listed

get_vulnerability, list_feed, check_stack, get_leaderboard, search

Quick config

{
  "mcpServers": {
    "cve-now-mcp-remote": {
      "type": "http",
      "url": "https://mcp.cve.now/mcp"
    }
  }
}

Add to config Opens the config generator with this server selected.

{
  "mcpServers": {
    "cve-now-mcp-remote": {
      "type": "http",
      "url": "https://mcp.cve.now/mcp"
    }
  }
}

FAQ

Is cve.now MCP (remote) deprecated?

No. cve-now-remote was not deprecated or archived when we last tested it on 2026-11-02.

What replaces cve.now MCP (remote)?

Nothing; cve.now MCP (remote) is not deprecated as of 2026-11-02.

Does cve.now MCP (remote) need an API key?

No. It completed an MCP handshake with no credentials and listed 5 tools.

Embed the badge

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Copy HTML

Copy Markdown Claim this listing · Report an issue