How to connect
Same URL, five paste targets. Ready surface · Auth required. Not a safe-to-install badge. Handshake this URL
Paste into Settings → MCP or .cursor/mcp.json.
{
"mcpServers": {
"cyanheads-nist-nvd-mcp-server": {
"url": "https://nist-nvd-mcp-server--cyanheads.run.tools"
}
}
}
Paste into .vscode/mcp.json.
{
"mcpServers": {
"cyanheads-nist-nvd-mcp-server": {
"url": "https://nist-nvd-mcp-server--cyanheads.run.tools"
}
}
}
Settings → Connectors → Add → Custom → Web. Paste the URL. Enable in a new chat.
Claude → Settings → Connectors → Add → Custom → Web
Name: nist-nvd-mcp-server
URL: https://nist-nvd-mcp-server--cyanheads.run.tools
OAuth only if this server requires it.
Save, start a new chat, enable the connector.
Developer mode custom connector. ChatGPT cannot reach localhost.
Settings → Apps & Connectors → Advanced → Developer mode ON
Create custom connector
Name: nist-nvd-mcp-server
MCP server URL: https://nist-nvd-mcp-server--cyanheads.run.tools
Auth: none unless the server requires OAuth
New chat → + → Developer mode → enable the connector
Register the HTTPS URL, then claude mcp list.
claude mcp add --transport http cyanheads-nist-nvd-mcp-server \
https://nist-nvd-mcp-server--cyanheads.run.tools
Pass on session/new as mcpServers when the agent advertised HTTP MCP.
[
{
"type": "http",
"name": "cyanheads-nist-nvd-mcp-server",
"url": "https://nist-nvd-mcp-server--cyanheads.run.tools"
}
]
Paste into a README or docs site. The widget loads snippets from Influzer — still not a SAFE badge.
Same handshake clock as this listing (overlay / warm / seed; live tools/list only if that is missing). Indigo is live_ok, amber is auth_required, gray is unreachable. Not a SAFE badge. Stdio listings have no badge.
[](https://www.influzer.ai/mcp/probe?url=https%3A%2F%2Fnist-nvd-mcp-server--cyanheads.run.tools)
<div data-influzer-install="cyanheads-nist-nvd-mcp-server"></div>
<script async src="https://www.influzer.ai/embed/install.js"></script>
https://www.influzer.ai/embed/mcp/cyanheads-nist-nvd-mcp-server.md
JSON: https://www.influzer.ai/api/v1/install/cyanheads-nist-nvd-mcp-server
Recipes using this server
No published recipes yet for this server.
Listing quality
Observable facts from our catalog and daily probe — not a safe-to-install badge.
- Surface
- Ready surface
- Auth gate
- Auth gate
- Tools source
- tools/list (live)
Observable catalog + probe facts — not a safe-to-install badge. How we verify.
Verification summary
Stored signals only. Not a safety score.
- Verification grade
- A (85)
- Last verified
- Status
- Auth required
- Response time
- 0 ms
- Auth
- Auth gate
- Transport
- http, HTTPS
- Tools indexed
- 5
- 30-day uptime
- 100% of 7 samples over 7 days
Probe history
- · auth_required · 0 ms
- · auth_required · 0 ms
- · auth_required · 0 ms
- · auth_required · 0 ms
- · auth_required · 0 ms
Tools
(5)-
nvd_get_cveFetch one or more CVEs by ID from the NIST National Vulnerability Database. Returns CVSS scores across all available versions (v2.0, v3.0, v3.1, v4.0), CWE weakness classifications, affected CPE configurations, CISA KEV fields, and references. Up to 100 CVE IDs per call. For bulk lookups of more than 10 IDs, use brief: true — full records for 100 CVEs can exceed 1MB and exhaust context budgets.
-
nvd_search_cvesSearch CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in queryMeta. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CV
-
nvd_audit_cpeFind all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. Use nvd_search_cpes first to resolve the correct CPE string for a product. Returns full CVE records.
-
nvd_search_cpesSearch the NVD CPE (Common Platform Enumeration) dictionary by product keyword or partial match string. Returns CPE names, human-readable titles, and deprecation status. Use before nvd_audit_cpe to resolve the correct CPE name for a product — CPE strings are precise identifiers (e.g., cpe:2.3:a:apache:http_server:2.4.51:*:*:*:*:*:*:*) and must match exactly to audit the right product.
-
nvd_get_cve_historyRetrieve the change history for a single CVE — CVSS score revisions, reference additions, status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. Use when tracking a CVE's escalation or investigating when a score changed. For the current record, call nvd_get_cve instead. The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD_API_KEY for reliable operation.
Tool source: tools/list (live) · last probed 2026-11-05