# NIST NVD MCP Server (`rl1987/nist-nvd-mcp-server`) Actor

MCP server exposing NIST NVD CVE search, CPE search, and CVSS v2/v3/v4 calculators as tools.

- **URL**: https://apify.com/rl1987/nist-nvd-mcp-server.md
- **Developed by:** [R.L.](https://apify.com/rl1987) (community)
- **Categories:** MCP servers, Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 price for completing a tool calls

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### NIST NVD MCP Server

An [MCP](https://modelcontextprotocol.io) server that exposes the [NIST National Vulnerability Database](https://nvd.nist.gov) to AI agents as tools — CVE search, CPE (product/platform) search, and native CVSS v2/v3.0/v3.1/v4.0 scoring, matching the data behind the [NVD vulnerability search](https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records), [CPE search](https://nvd.nist.gov/products/cpe/search), and [CVSS v4 calculator](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator) pages. Built on [FastMCP](https://gofastmcp.com) and deployed as an [Apify Actor](https://docs.apify.com/platform) in Standby mode, so it runs as a persistent HTTP endpoint rather than a one-shot batch job.

#### Why use this?

Security teams, vulnerability management tools, and AI coding assistants need to look up CVE details, check what a given CPE (software/hardware identifier) is vulnerable to, and score custom vulnerability findings against the CVSS standard — without hand-rolling calls to NVD's REST API or re-deriving the CVSS math. This server wraps all three into MCP tools an agent can call directly, with built-in NVD rate-limit handling and retries. Running it on Apify gives you a hosted, always-on endpoint with API-token auth and usage-based billing, instead of self-hosting.

#### How to use

1. If you don't have one, create a free [Apify account](https://console.apify.com/sign-up) and grab your API token from [console.apify.com/settings/integrations](https://console.apify.com/settings/integrations).
2. Open this Actor's page in Apify Console and copy its MCP endpoint URL from the **API** tab (it looks like `https://rl1987--nist-nvd-mcp-server.apify.actor/mcp`).
3. Connect your MCP client (Claude Code, Claude Desktop, an agent framework, etc.) to that URL over Streamable HTTP, passing your Apify API token as a Bearer token — see **Connect to Claude Code** below for the exact command.
4. Call `search_cves`, `get_cve`, `search_cpes`, or `calculate_cvss_score` from your agent. You're billed per completed tool call — see **Pricing**.

#### Connect to Claude Code

With the Actor's MCP endpoint URL and your Apify API token from above, run:

```bash
claude mcp add --transport http nist-nvd https://rl1987--nist-nvd-mcp-server.apify.actor/mcp \
  --header "Authorization: Bearer <YOUR_APIFY_API_TOKEN>"
```

Replace `<YOUR_APIFY_API_TOKEN>` with your own Apify API token — not the Actor owner's.

- This adds the server at `local` scope (private, current project only). Add `--scope user` instead to make it available in every project on your machine.
- Verify it connected: run `claude mcp list`, or type `/mcp` in an interactive Claude Code session — `nist-nvd` should show as connected with 4 tools.
- Try it: ask Claude *"look up CVE-2021-44228 in NVD"* or *"what's the CVSS v4 base score for CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"* — it will call the tools directly.
- Remove it later with `claude mcp remove nist-nvd`.

If you're on a team and want everyone to pick up this server automatically, commit a `.mcp.json` with just the URL (never the token) to your repo root:

```json
{
  "mcpServers": {
    "nist-nvd": {
      "type": "http",
      "url": "https://rl1987--nist-nvd-mcp-server.apify.actor/mcp"
    }
  }
}
```

Each teammate then runs the `claude mcp add ... --scope local` command above once with their own token, which layers on top of the shared `.mcp.json` config without ever touching the repo.

#### Input

No Actor input is required to start the server — it runs in Standby mode and accepts MCP tool calls directly over HTTP. Optionally set the `NVD_API_KEY` environment variable (free from [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key)) to raise the NVD rate limit from 5 to 50 requests per 30 seconds.

#### Tools

- **search\_cves** — search CVE records by keyword, CVE ID, CPE name, CVSS v2/v3/v4 severity, CWE, vuln status, source, date range, or CISA KEV flag. Paginated.
- **get\_cve** — fetch a single CVE record by ID (e.g. `CVE-2021-44228`).
- **search\_cpes** — search CPE product/platform records by keyword, CPE match string, or CPE name ID. Paginated.
- **calculate\_cvss\_score** — score any CVSS v2, v3.0, v3.1, or v4.0 vector string (version auto-detected from the vector prefix) and return the base/temporal/environmental scores and severities.

#### Output

Each tool returns a human-readable summary plus structured content. Example `get_cve` output:

```json
{
  "id": "CVE-2021-44228",
  "sourceIdentifier": "security@apache.org",
  "published": "2021-12-10T10:15:09.143",
  "vulnStatus": "Analyzed",
  "description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP...",
  "cvssMetrics": {
    "cvssV3_1": { "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL" }
  },
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "references": [{ "url": "https://logging.apache.org/log4j/2.x/security.html", "source": "security@apache.org", "tags": ["Vendor Advisory"] }],
  "cisaKev": true
}
```

`calculate_cvss_score` output:

```json
{
  "version": "3.1",
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "baseScore": 9.8,
  "baseSeverity": "Critical"
}
```

#### Pricing

This Actor uses [Pay Per Event](https://docs.apify.com/platform/actors/publishing/monetize#pay-per-event-pricing-model) pricing: a flat fee per completed tool call (see `.actor/pay_per_event.json`). There is no charge for failed calls or for connecting/idling.

#### Tips

- Pass a free `NVD_API_KEY` to avoid NVD's tighter unauthenticated rate limit (5 req/30s vs 50 req/30s with a key).
- Use `pub_start_date`/`pub_end_date` or `last_mod_start_date`/`last_mod_end_date` (max 120-day span, ISO-8601) to page through large result sets instead of relying on `keyword` alone.
- `cpe_match_string` accepts a partial CPE 2.3 URI, e.g. `cpe:2.3:o:microsoft:windows_10`, to browse a vendor/product family.

#### FAQ

This Actor only reads publicly published NIST NVD data via NVD's own REST API — it does not scrape or bypass any access controls. CVSS scoring is computed locally using a spec-conformant implementation, not by calling NIST's calculator pages. NVD API availability and rate limits are outside this Actor's control; see [nvd.nist.gov/developers](https://nvd.nist.gov/developers) for their current terms. Report issues via the Actor's Issues tab.

# Actor input Schema

## Actor input object example

```json
{}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("rl1987/nist-nvd-mcp-server").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("rl1987/nist-nvd-mcp-server").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call rl1987/nist-nvd-mcp-server --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=rl1987/nist-nvd-mcp-server",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/pgx8ivC2euKGH5Hdc/builds/12KHyQOkgNbQIXeiW/openapi.json