NNIST NVD MCP

Tested npm @cyanheads/nist-nvd-mcp-server 0.4.0 (Apache-2.0; repo cyanheads/nist-nvd-mcp-server, 2 GitHub stars when checked; community project, not made by NIST). Stdio, 5 read-only tools over the public NIST National Vulnerability Database API, no key (NVD rate-limits keyless use; an optional NVD API key raises the limit). Real calls: nvd_get_cve for CVE-2021-44228 returned the full Log4Shell record with CVSS scores and CISA KEV data, nvd_search_cves for 'log4j jndi' returned matching CVEs, and nvd_search_cpes for 'openssl' returned CPE names.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): pass. 3 of 3 read calls passed against the public NVD API, no key. Evidence: local test run, Nov 11, 2026.

Transport (tested 2026-11-11): stdio

Score 100/100 · Tools 5 · Token cost approx. 2,583 tokens · Compare · Last tested 2026-11-11 · Version tested 0.4.0 · Package @cyanheads/nist-nvd-mcp-server · Repo cyanheads/nist-nvd-mcp-server

Summary: NIST NVD MCP completed an MCP handshake without credentials and exposed 5 tools.

Evidence summary

Handshake

pass

Tools listed

5

Context cost

approx. 2583 tokens, cl100k estimate (5 tools, measured 2026-11-11, version 0.4.0; an estimate) ranking · add up your servers' context cost

API key

No key needed for the tools we called

Tested

2026-11-11

Test results

Local-model readiness

Token cost (estimate): approx. 2583 tokens, cl100k estimate for 5 tools · about 32% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

What we tested and what we didn't

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

{
  "name": "@cyanheads/nist-nvd-mcp-server",
  "version": "0.4.0",
  "registry": "npm",
  "status": "working",
  "tested": "2026-11-11",
  "tools_count": 5,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`npm install @cyanheads/nist-nvd-mcp-server` (Node 20, Linux) succeeded in 1s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 5 tools listed in 2.6s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 16 days before test; 2 GitHub stars."
    ],
    "docs": [
      "pass",
      15,
      "README over 3,000 chars; install instructions present; `mcpServers` config example present. Check of the package's own README (README shipped in npm package)."
    ],
    "license": [
      "pass",
      10,
      "Apache-2.0 (OSI-approved)."
    ]
  }
}

Install

npx -y @cyanheads/nist-nvd-mcp-serverCopy

Pin the version we tested

npx -y @cyanheads/nist-nvd-mcp-server@0.4.0Copy

tested 2026-11-11. Newer versions may differ and were not tested by us.

{
  "mcpServers": {
    "nist-nvd-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/nist-nvd-mcp-server@0.4.0"
      ]
    }
  }
}

Tools listed

nvd_audit_cpe, nvd_get_cve, nvd_get_cve_history, nvd_search_cpes, nvd_search_cves

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "nist-nvd-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/nist-nvd-mcp-server"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

{
  "mcpServers": {
    "nist-nvd-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/nist-nvd-mcp-server"
      ]
    }
  }
}

FAQ

Is NIST NVD MCP deprecated?

No. @cyanheads/nist-nvd-mcp-server was not deprecated or archived when we last tested it on 2026-11-11.

What replaces NIST NVD MCP?

Nothing; NIST NVD MCP is not deprecated as of 2026-11-11.

Does NIST NVD MCP need an API key?

No. It completed an MCP handshake with no credentials and listed 5 tools.

Embed the badge

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Copy HTML

Copy Markdown Claim this listing · Report an issue