Back to Home
davidculver icon

cve-mcp-server

Verified Safe

by davidculver

Overview

Provides conversational access to a local, containerized CVE (Common Vulnerabilities and Exposures) database via Model Context Protocol (MCP).

Installation

Run Command
sudo docker exec -i cve-mcp-server python -m src.mcp_server

Environment Variables

  • CVE_REPO_URL
  • CVE_REPO_PATH
  • CVE_GITHUB_API_BASE
  • CVE_DB_PATH

Security Notes

The server is designed for local-only use with stdio transport, minimizing network attack surface. It uses parameterized queries for SQLite operations to prevent SQL injection. Configuration (e.g., repository URLs) is loaded from environment variables, preventing hardcoded secrets. The data ingestion process uses `subprocess.run` for `git clone` from a trusted public repository (CVEProject/cvelistV5) for bulk data loading, which is a controlled external execution. The project is explicitly marked as a 'PROTOTYPE' and mentions future network access (SSE transport) would introduce new security considerations, but currently, it operates locally via stdio.

Similar Servers

Stats

Interest Score0
Security Score9
Cost ClassMedium
Avg Tokens1500
Stars0
Forks0
Last Update2025-12-30

Tags

CVEsecurityvulnerabilitieslocal-databaseMCP