CIRCL CVE SEARCH MCP Server

A Model Context Protocol (MCP) server for accessing CIRCL's Vulnerability-Lookup platform, providing comprehensive, cross-source vulnerability and security information.

This server previously used the legacy cve.circl.lu cve-search API. CIRCL has superseded that service with Vulnerability-Lookup, so this server now talks to https://vulnerability.circl.lu/api.

Features

This MCP server provides reliable tools to access:

• CVE Information: Get detailed information about specific Common Vulnerabilities and Exposures
• Vendor Browsing: Browse known products for a vendor to discover security issues in specific vendors' products
• CWE Information: Get Common Weakness Enumeration information for understanding vulnerability types
• CAPEC Information: Get Common Attack Pattern Enumeration and Classification data for understanding attack methods
• Recent Vulnerabilities: Get the most recently published/updated vulnerabilities, correlated across all sources tracked by the platform

Key Improvements

• Retry Logic: Automatic retry with exponential backoff for reliable API calls
• Enhanced Formatting: Structured, readable response formatting with key information highlighted
• Better Error Handling: Clear, actionable error messages with troubleshooting guidance
• Input Validation: Comprehensive validation and sanitization of all inputs

Installation

npm install @cyreslab/circl-cve-search-mcp-server

Usage

Add this server to your MCP client configuration:

{
  "mcpServers": {
    "circl-cve-search": {
      "command": "npx",
      "args": ["@cyreslab/circl-cve-search-mcp-server"]
    }
  }
}

Available Tools

get_cve

Get detailed information about a specific CVE by its ID.

Parameters:

• cve_id (required): CVE identifier (e.g., "CVE-2021-44228")

Example:

{
  "name": "get_cve",
  "arguments": {
    "cve_id": "CVE-2021-44228"
  }
}

Response Format:

• Structured CVE data with key information highlighted
• Summary, publication dates, CVSS scores
• Associated weakness types (CWE) and reference counts
• Full raw data for detailed analysis

browse_vendor

Browse known products for a vendor, sorted by most recent vulnerability activity.

Parameters:

• vendor (required): Vendor name (e.g., "apache", "microsoft", "google")
• limit (optional): Number of results to return (default: 10, max: 50)

Example:

{
  "name": "browse_vendor",
  "arguments": {
    "vendor": "apache",
    "limit": 15
  }
}

Response Format:

• List of known products for the specified vendor, each with a last-change timestamp
• Total count and displayed count
• Vendor name normalization

get_cwe

Get Common Weakness Enumeration (CWE) information by ID.

Parameters:

• cwe_id (required): CWE identifier (e.g., "CWE-79", "CWE-89")

Example:

{
  "name": "get_cwe",
  "arguments": {
    "cwe_id": "CWE-79"
  }
}

Response Format:

• CWE name and detailed description
• Extended descriptions and weakness ordinalities
• Likelihood of exploit information
• Full raw data for comprehensive analysis

get_capec

Get Common Attack Pattern Enumeration and Classification (CAPEC) information by ID.

Parameters:

• capec_id (required): CAPEC identifier (e.g., "CAPEC-66", "CAPEC-89")

Example:

{
  "name": "get_capec",
  "arguments": {
    "capec_id": "CAPEC-66"
  }
}

Response Format:

• Attack pattern name and description
• Typical severity and likelihood of attack
• Prerequisites and related weaknesses
• Complete raw data for in-depth analysis

get_recent_vulnerabilities

Get the most recently published/updated vulnerabilities, correlated across all sources tracked by the platform (e.g. NVD, GitHub, PySec, GSD, CSAF advisories from various vendors).

Parameters:

• limit (optional): Number of results to return (default: 10, max: 50)

Example:

{
  "name": "get_recent_vulnerabilities",
  "arguments": {
    "limit": 10
  }
}

Response Format:

• List of recently changed vulnerabilities, normalized across the platform's different native record formats (OSV-style records, CVE 5.x records, and CSAF advisories)
• Identifier(s), publication/modification dates, a truncated summary, severity, and reference count for each

Data Source

This server uses CIRCL's Vulnerability-Lookup platform, which superseded the legacy cve-search service formerly hosted at cve.circl.lu. It provides:

• Cross-source correlated vulnerability data (NVD, GitHub, PySec, GSD, CSAF advisories from various vendors, and more)
• Common Platform Enumeration (CPE) information
• Common Weakness Enumeration (CWE) data
• Common Attack Pattern Enumeration and Classification (CAPEC) data
• Continuous updates with the latest vulnerability information

Rate Limiting

The CIRCL Vulnerability-Lookup API is free to use and doesn't require authentication. However, please use it responsibly and avoid making excessive requests that could impact the service.

Error Handling

The server handles various error conditions:

• Invalid CVE/CWE/CAPEC ID formats
• Empty search queries
• API rate limiting
• Network errors
• Invalid parameters

Development

Building

npm run build

Running in Development

npm run dev

License

MIT License - see LICENSE file for details.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Support

For issues and questions:

• GitHub Issues: Report an issue
• CIRCL Vulnerability-Lookup API Documentation: https://vulnerability.circl.lu/api/