mcpField
C
cve-cache

cve-cache

Local
github.com/weiseerSecurity0Updated 21w ago
Repository

About cve-cache

cve-cache is a cached CVE and GHSA service for AI agents auditing dependencies or screening packages. It provides structured recent records and package lookups across several ecosystems.

Key features

  1. 01Look up a CVE or GHSA record
  2. 02Find vulnerabilities by package ecosystem
  3. 03List recent critical CVEs
  4. 04Count records by severity
  5. 05Support npm, PyPI, Cargo, Maven, and Go

Use cases

  1. 01Audit project dependencies for known vulnerabilities
  2. 02Screen newly introduced packages
  3. 03Review recent critical vulnerability trends

MCP support

This stdio MCP server exposes tools for vulnerability lookups, package searches, recent critical CVE listings, and severity summaries.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "weiseer-cve-cache": {
      "command": "npx",
      "args": [
        "-y",
        "@weiseer/cve-cache-mcp"
      ],
      "env": {
        "CVE_CACHE_URL": "<CVE_CACHE_URL>",
        "CVE_CACHE_LOCAL_ONLY": "<CVE_CACHE_LOCAL_ONLY>"
      }
    }
  }
}
Run commandnpx -y @weiseer/cve-cache-mcp
Environment variables to set
CVE_CACHE_URLOverride remote snapshot URL
CVE_CACHE_LOCAL_ONLYSkip remote fetch

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@weiseer/cve-cache-mcp0.1.1

Tools

4

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
cve_idstringYese.g. CVE-2024-12345 or GHSA-xxxx-xxxx-xxxx

Details

From the project README

@weiseer/cve-cache-mcp

Recent CVE + GHSA cache as a stdio MCP server.

Probe P-005 by weiseer.

What it does

Cached, structured snapshot of recent CVE + GitHub Security Advisory records — for AI agents auditing dependencies or screening new packages.

Your agent can:

  • lookup_cve — full record for one CVE/GHSA ID
  • find_for_package — all CVEs affecting a package by ecosystem (npm/PyPI/Cargo/Maven/Go)
  • list_recent_critical — recent high-severity CVEs (default: 7-day, CVSS ≥ 7)
  • severity_summary — counts by severity bucket

Why use this instead of your agent querying NVD itself

Agent DIYcve-cache
Source queryNVD JSON feeds + GHSA GraphQL1 MCP call
Token cost (NVD records are large)$0.05-0.20$0 free / $0.00005 paid
Latency2-10 seconds<100ms
Cross-ecosystem normalizationPer-source schemaPre-normalized

Install

npm install -g @weiseer/cve-cache-mcp

Use with Claude Desktop / Cursor / Cline / Continue / Windsurf

{
  "mcpServers": {
    "cve-cache": {
      "command": "npx",
      "args": ["-y", "@weiseer/cve-cache-mcp"]
    }
  }
}

License

Apache-2.0. Catalog data: derived from public CVE/NVD/GHSA feeds (CC0/public domain).

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.