cve-mcp-server

Dependency freshness

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

AI

MCP SDK

API layer

Pydantic

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

• Other
  One-call CVE triageOne-call triage that fans out NVD + EPSS + CISA KEV
• Other
  Composite risk scoringcomputes the composite risk score with a KEV hard override
• Other
  NVD fallback sourcefalls back to VulnCheck NVD++ when NIST NVD is throttled
• Other
  SSVC v2 decisionemits the SSVC v2 gated decision
• Other
  CVE record lookupFetch detailed CVE record from NVD including CVSS scores
• Other
  CVE keyword searchSearch NVD for CVEs by keyword, product name, severity
• Other
  EPSS exploitation scoresGet EPSS exploitation probability (0–1) and percentile
• Other
  CISA KEV checkCheck whether a CVE appears in CISA's Known Exploited Vulnerabilities catalog
• Other
  CVSS vector breakdownParse and explain a CVSS v3.1 vector string with per-metric breakdown
• Other
  CWE database lookupLook up Common Weakness Enumeration details by CWE ID
• Other
  Bulk CVE lookupBatch-fetch details for up to 20 CVEs in a single call
• Other
  MITRE ATT&CK mappingMap a CVE or CWE to relevant MITRE ATT&CK techniques
• Other
  Executive risk reportsGenerate a formatted executive security report for one or more CVEs
• Other
  Dependency vulnerability scanScan package names and versions against OSV.dev for known vulnerabilities

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.